In many countries, companies must notify all persons affected in the case of a data breach. However, in the US there is still no single federal law governing this. This means different states have introduced different laws regarding data breaches.
New York State is no different, it has its own law requiring businesses to inform customers if their data has been breached. It is called the NYS Information Security Breach and Notification Act.