Summary. A data breach is an operational crisis with a legal deadline attached, and the deadline usually arrives before the facts do. Every state has a notification statute, they define covered information and trigger notification differently, and a single incident affecting customers nationwide requires satisfying all of them simultaneously along with any sector-specific federal regime that applies. The decisions that determine both regulatory exposure and litigation outcome are made in the first week: how the forensic investigation is structured and whether it is privileged, whether to pay a ransom, what the notification says, and what the company tells regulators and the market. This article covers the first seventy-two hours, the notification analysis across state and federal regimes, the litigation that follows, and the preparation that makes all of it survivable.

The call comes on a Friday afternoon. The security team has found something. They are not sure what it is yet, they are not sure how long it has been there, and they are not sure what it touched.

Everything about the next thirty days will be judged against decisions made in the next thirty-six hours, and most of those decisions have to be made without the facts. That is the defining feature of breach response: the legal deadlines run from discovery, not from understanding, and a company that waits for certainty before acting has usually missed something.

The first seventy-two hours

Convene, and get counsel in first

Assemble the incident response team: security, IT, legal, communications, privacy, HR, and the business owner of the affected system. Bring in outside counsel immediately, before engaging a forensic firm, for reasons explained below.

Designate a single decision-maker. Incident response fails on diffusion of authority more than on technical shortfalls.

Contain, but preserve

The instinct is to wipe and rebuild. Resist it long enough to image the affected systems. Volatile evidence — memory, running processes, network connections — is lost on reboot, and it is frequently the only way to determine what an attacker did.

Preserve logs immediately. Most organizations retain firewall, VPN, authentication, and endpoint logs for a limited period, and the retention window is often shorter than the dwell time of the intrusion. A company that discovers a six-month-old compromise with ninety days of logs cannot determine what happened, which affects the notification analysis directly.

Suspend automatic deletion. Issue a litigation hold.

Structure the investigation for privilege

This matters enormously and is routinely done wrong.

The pattern that has worked: outside counsel retains the forensic firm, under an engagement letter stating that the work is at counsel's direction for the purpose of providing legal advice and in anticipation of litigation. The forensic firm reports to counsel, not to the company's IT organization. The report is addressed to counsel, marked privileged, and distributed on a need-to-know basis.

The pattern that has failed: In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. 2020), ordered production of a forensic report where the company had a pre-existing contract with the firm, the work was substantially the same as the firm's ordinary services, the cost was paid from the business budget, and the report was widely distributed internally. In re Rutter's Inc. Data Security Breach Litigation, 2021 WL 3733137 (M.D. Pa. 2021), reached a similar result.

The practical guidance:

  • Two workstreams, two firms where possible. One firm does the business-purpose remediation work, unprivileged. A separate firm does the litigation-purpose investigation under counsel.
  • New engagement letter for the incident, not a statement of work under a pre-existing MSA.
  • Legal budget, not IT budget.
  • Restrict distribution severely.
  • Assume, regardless, that the report may be produced. Do not write anything in it you would not want read aloud.

Notify the insurer

Cyber policies have short notice provisions, and most require the insurer's consent to the choice of counsel and forensic vendor — frequently from a panel list. Engaging your own firm before tendering can forfeit coverage for those costs. Tender within the first day.

Decide about law enforcement

FBI or Secret Service involvement can produce useful intelligence, may support a delay in notification where a statute permits it for law enforcement purposes, and is favorably viewed by regulators. It also means loss of control over timing and the possibility that the government seizes equipment.

For ransomware, law enforcement contact is strongly recommended, and CISA and the FBI maintain reporting channels.

The ransom question

If it is ransomware, the ransom decision arrives fast.

It is not straightforwardly illegal, but OFAC's advisory on potential sanctions risks for facilitating ransomware payments makes clear that a payment to a sanctioned person or jurisdiction violates the sanctions regulations on a strict liability basis, and that a company, its counsel, its insurer, and its incident response vendor may all face exposure. The practical requirement is a documented sanctions diligence process on the threat actor before any payment, conducted by a vendor that does this work, plus a record of the analysis.

Considerations beyond legality: whether backups permit recovery, whether the decryptor works (frequently it works poorly), whether payment prevents publication of exfiltrated data (it frequently does not), and whether payment marks the company as a repeat target.

Payment does not affect the notification obligation. Data that was exfiltrated was acquired, and a promise to delete it is worth nothing.

Notification: the analysis

The state statutes

All fifty states, plus the District of Columbia and the territories, have breach notification laws. They share a structure and differ in every detail that matters.

What is covered. The core definition is a resident's first name or initial and last name plus a data element: Social Security number, driver's license or state ID number, or financial account number with a code permitting access. Many states have expanded to include medical information, health insurance information, biometric data, username-and-password combinations, taxpayer identification numbers, passport numbers, and digital signatures. A few states cover information without a name where the elements alone permit identification.

What triggers. Most statutes require acquisition of covered information by an unauthorized person; some require only access, which is broader. Many include a risk of harm assessment permitting the company to forgo notification if, after investigation, it concludes there is no reasonable likelihood of harm — usually with a documentation requirement and, in some states, notification to the attorney general of the determination.

Encryption safe harbors exist nearly everywhere, but they generally fail if the key was also compromised, which in a domain-wide compromise it often was.

Timing. Most states require notification in the most expedient time possible and without unreasonable delay. A growing number impose outer limits — thirty, forty-five, or sixty days from discovery. Some permit delay for law enforcement.

Content. Several states prescribe required elements: a description of the incident, the categories of information involved, the date or date range, what the company is doing, what the individual can do, contact information, and in some states specific language about credit reporting agencies, credit freezes, and the FTC.

Regulator notification. Most states require notice to the attorney general, some at any breach and some above a threshold of affected residents. A number require notification to state consumer protection agencies or, for certain sectors, to specific regulators.

Credit monitoring. A handful of states require offering it — commonly twelve or twenty-four months — where Social Security numbers were involved. Elsewhere it is customary and effectively expected.

Consumer reporting agencies must be notified where the number of affected residents exceeds a threshold, commonly one thousand.

The practical consequence is that a nationwide incident requires a fifty-state matrix: for each state, the covered data elements, the trigger, whether a risk assessment is permitted, the deadline, required content, regulator obligations, and credit monitoring requirements. Building this matrix during an incident is too slow. It should exist beforehand and be updated annually.

Federal and sectoral regimes

HIPAA. The Breach Notification Rule at 45 C.F.R. §§ 164.400–164.414 applies to covered entities and business associates. Unsecured protected health information is presumed breached unless a four-factor risk assessment demonstrates a low probability of compromise: the nature and extent of the PHI, the unauthorized person who used or received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. Notification to individuals within sixty days; to HHS within sixty days for breaches affecting five hundred or more individuals and annually for smaller ones; and to prominent media outlets where five hundred or more residents of a state are affected. Business associates must notify the covered entity, and the timeline in the business associate agreement usually shortens the sixty days considerably.

GLBA. The FTC's Safeguards Rule at 16 C.F.R. Part 314 requires a written information security program and, as amended, notification to the FTC within thirty days of discovering a security event involving unencrypted customer information of five hundred or more consumers. Banking regulators separately require notification of a computer-security incident to the primary federal regulator within thirty-six hours under 12 C.F.R. Parts 53, 225, and 304.

SEC. Item 1.05 of Form 8-K requires a public company to disclose a material cybersecurity incident within four business days of determining materiality — not of discovery. Regulation S-K Item 106 requires annual disclosure of risk management, strategy, and governance. The materiality determination must be made without unreasonable delay, and it is the judgment most likely to be second-guessed. A limited delay is available where the Attorney General determines disclosure poses a substantial risk to national security or public safety.

CIRCIA. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 requires covered entities in critical infrastructure sectors to report substantial cyber incidents to CISA within seventy-two hours and ransom payments within twenty-four hours. The implementing rule has been in development with an extended timeline; confirm the current effective date and covered-entity definition before assuming the obligation does or does not apply.

Other regimes that may attach: state insurance data security laws following the NAIC model, adopted in a majority of states with a seventy-two-hour regulator notification requirement; the New York Department of Financial Services cybersecurity regulation at 23 N.Y.C.R.R. Part 500, with a seventy-two-hour notification and an annual certification; FERC and NERC CIP standards for the bulk electric system; the FCC's rules for telecommunications carriers; and Department of Defense contract clauses at DFARS 252.204-7012 requiring reporting within seventy-two hours.

International. The GDPR requires notification to the supervisory authority within seventy-two hours of becoming aware, unless the breach is unlikely to result in a risk to individuals, and to data subjects without undue delay where the risk is high. Other jurisdictions have their own timelines, several shorter.

The controlling deadline is the shortest one that applies. For a company with European customers, financial services operations, and a NYDFS license, the seventy-two-hour clocks govern, and the state statutes' thirty-day outer limits are irrelevant.

Litigation

The claims

Negligence and negligence per se, the workhorse claims. The duty question — whether a company owes a duty to safeguard data — has been resolved in plaintiffs' favor in most jurisdictions, though the economic loss rule remains a real obstacle in several.

Breach of implied contract, on the theory that the customer relationship included an implicit promise of reasonable security.

State consumer protection statutes, including unfairness theories.

Statutory claims with damages built in. The California Consumer Privacy Act at Cal. Civ. Code § 1798.150 provides a private right of action for a breach of unencrypted, unredacted personal information resulting from a failure to maintain reasonable security, with statutory damages of one hundred to seven hundred fifty dollars per consumer per incident. This provision, more than any other, changed the economics of data breach litigation. Illinois's Biometric Information Privacy Act likewise provides statutory damages and has produced very large settlements.

Fiduciary and confidentiality claims in the healthcare and financial sectors.

Securities claims where disclosure was inadequate, and derivative claims framed as Caremark oversight failures.

Standing

The threshold fight. Clapper v. Amnesty International USA, 568 U.S. 398 (2013), requires that threatened injury be certainly impending. Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), requires a concrete injury. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), held that a plaintiff must suffer concrete harm and that a mere risk of future harm, without materialization, does not support damages standing — and that every class member must have standing for damages.

The circuits divide on whether the risk of future identity theft from a data breach is sufficient. Courts generally find standing where data was actually misused, where the data is highly sensitive such as Social Security numbers, or where the attacker's evident purpose was fraud, and more often find it lacking where the exposure was inadvertent and the data less sensitive. Mitigation costs — credit monitoring purchased in response — are accepted as injury in some circuits and rejected as self-inflicted in others under Clapper.

Class certification and settlement

Predominance under Rule 23(b)(3) is contested because damages vary and because state law differs across a nationwide class — which frequently produces state subclasses or certification limited to a single state.

Settlements typically combine credit monitoring and identity restoration services, reimbursement of documented out-of-pocket losses with a cap, an alternative cash payment for class members who do not document losses, statutory damages in California, and injunctive relief specifying security improvements. Objectors and courts scrutinize claims rates, and low-participation settlements draw appellate attention.

Regulatory exposure

FTC actions under Section 5 for unfair or deceptive practices, resulting in consent orders with twenty-year terms, mandated assessments, and increasingly specific security requirements. State attorney general actions, frequently as a multistate group, which now regularly resolve for substantial sums with detailed injunctive terms. HHS Office for Civil Rights enforcement of the HIPAA Security Rule. Banking regulator enforcement. And sector-specific regulators with their own authorities.

Writing the notification

The notice is read by consumers, by regulators, by plaintiffs' counsel, and eventually by a jury. Every sentence should be written with all four in mind.

Say what happened, plainly. Vague constructions — "an incident involving our systems" — read as evasion and are quoted back. State what occurred, when it was discovered, and what information was involved.

Do not say more than you know. A statement that "no information was misused" that later proves wrong converts a security failure into a misrepresentation, which is the FTC's preferred theory and a much worse claim. Prefer "we have no evidence that" over "there was no."

Do not blame the victim or the vendor gratuitously. Both read badly, and attributing a breach to a vendor raises the obvious question of the company's own vendor management.

Include the state-required elements for every state where a recipient resides. The practical approach is a single notice containing the superset of required content, with state-specific addenda where a state mandates particular language.

Give people something to do. Credit monitoring enrollment with a real deadline and a simple activation process, guidance on credit freezes, and a staffed call center with people who can answer questions. Call center scripts should be reviewed by counsel; a representative who improvises is making statements on behalf of the company.

Coordinate the timing. Individual notices, regulator notices, the consumer reporting agency notice, any 8-K, the website posting, the press statement, and employee talking points should all land together. A regulator who reads about the breach in the press before receiving notice remembers it.

Have the substitute notice ready. Where contact information is unavailable or the cost exceeds a statutory threshold, most statutes permit substitute notice — email, a conspicuous website posting, and statewide media. The requirements are specific and vary.

Preparation

Everything above is easier for a company that did the work in advance, and nearly all of it can be done in advance.

An incident response plan that names roles rather than departments, includes contact information that is current, and lives somewhere accessible when the network is down — printed, or in an out-of-band system.

Pre-negotiated vendor relationships: outside counsel, a forensic firm, a notification and call center vendor, a public relations firm, and a ransomware negotiation specialist. Retainers in place, engagement terms agreed, and confirmed as acceptable to the cyber insurer.

The fifty-state notification matrix, current.

A data map. What personal information the company holds, where it lives, which systems process it, who has access, and what the retention period is. A company that cannot answer these questions in an incident spends two weeks answering them under pressure — and every day of that delay is visible to regulators. The corollary is that data minimization is the single most effective breach mitigation available: information deleted on schedule cannot be exfiltrated.

Vendor contracts with security requirements, prompt notification obligations shorter than the company's own deadlines, audit rights, indemnification, and cooperation duties. Vendor breaches are a large and growing share of incidents, and the contract is the only leverage available once one occurs.

Cyber insurance, reviewed for what it actually covers: forensics, notification, call center, credit monitoring, legal defense, regulatory fines where insurable, business interruption, ransom payment, and the sublimits on each. Check the panel requirements and the notice provisions before an incident.

Tabletop exercises, annually, with the executive team present. The purpose is not to test the technology. It is to discover that nobody knows who decides whether to pay a ransom, that the general counsel's mobile number in the plan is three years old, and that the communications lead assumed legal would draft the notice.

Governance. Boards now face oversight exposure for cybersecurity as a Caremark risk, and SEC disclosure requirements make board oversight a public matter. Regular reporting to the board, documented in minutes, is both good practice and the record that defends it.

Primary authority

  • State breach notification statutes in all fifty states, the District of Columbia, and the territories — varying in covered data elements, acquisition versus access triggers, risk-of-harm exceptions, outer deadlines, required content, attorney general notification, and credit monitoring mandates.
  • Cal. Civ. Code § 1798.150 — the CCPA private right of action and statutory damages; Cal. Civ. Code § 1798.82 — California's notification statute; 740 Ill. Comp. Stat. 14/ — the Biometric Information Privacy Act.
  • 45 C.F.R. §§ 164.400–164.414 — the HIPAA Breach Notification Rule and its four-factor presumption; 45 C.F.R. Part 164, Subpart C — the Security Rule.
  • 16 C.F.R. Part 314 — the FTC Safeguards Rule, including the thirty-day FTC notification requirement; 16 C.F.R. Part 318 — the Health Breach Notification Rule.
  • 12 C.F.R. Parts 53, 225, and 304 — the banking agencies' thirty-six-hour computer-security incident notification rule.
  • 17 C.F.R. § 229.106 and Form 8-K Item 1.05 — SEC cybersecurity disclosure.
  • 6 U.S.C. §§ 681–681g (CIRCIA) — CISA reporting for critical infrastructure, subject to the implementing rule's effective date.
  • 23 N.Y.C.R.R. Part 500 — the NYDFS cybersecurity regulation; NAIC Insurance Data Security Model Law as adopted by state.
  • DFARS 252.204-7012 and NIST SP 800-171 — defense contractor safeguarding and reporting.
  • GDPR Articles 33 and 34 — supervisory authority and data subject notification.
  • 15 U.S.C. § 45 — the FTC Act's unfairness and deception authority, the basis of most federal data security enforcement.
  • OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments.
  • Clapper v. Amnesty International USA, 568 U.S. 398 (2013), Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) — standing.
  • In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. 2020) and In re Rutter's Inc. Data Security Breach Litigation, 2021 WL 3733137 (M.D. Pa. 2021) — privilege over forensic reports.
  • Fed. R. Civ. P. 26(b)(3) and Fed. R. Evid. 502(d) — work product and non-waiver.

A worked incident

Monday, 6:40 a.m. A managed service provider alerts a mid-sized specialty retailer that anomalous authentication activity has been detected on a server hosting the e-commerce order database. The security lead confirms an unfamiliar account with administrative privileges created eleven days earlier.

Hour one. Outside counsel engaged by phone. The insurer is tendered. Counsel retains a forensic firm from the insurer's panel under a new engagement letter, at counsel's direction, billed to the legal budget. The MSP is instructed to preserve rather than remediate and to snapshot the affected hosts before any change.

Hour four. Logs pulled. The retailer keeps ninety days of authentication logs and thirty days of network flow data — a gap that will limit what can ever be known about the initial access vector. Litigation hold issued. Automatic log rotation suspended.

Day two. Forensics identifies exfiltration of a database export. The export is confirmed to contain names, email addresses, shipping addresses, and order histories for approximately 240,000 customers, and — for approximately 31,000 customers who used a legacy checkout flow retired in 2021 — the last four digits of card numbers together with expiration dates.

The notification analysis begins. Names plus email addresses and order history are, standing alone, outside the covered-data definition in most state statutes. But several states now cover expanded categories, and the legacy card data raises the harder question: last four digits plus expiration date, without a full number or security code, does not fit the classic "account number with an access code" formulation in most statutes — and does fit some.

This is exactly the analysis where a pre-built fifty-state matrix pays for itself. Without one, counsel is reading statutes for a week while the clock runs.

Day four. The company determines that at least eleven states require notification, that four permit a documented risk-of-harm determination, and that two require attorney general notice regardless. Because the customer base is nationwide, and because differential notification is difficult to defend and worse in the press, the decision is made to notify everyone — a common and usually correct call.

Day five. The materiality assessment for SEC purposes concludes the incident is not material to the company's financial condition. The determination and its basis are documented contemporaneously, because the SEC's inquiry will be into the process and its timing, not merely the conclusion.

Day nine. Notice letters mailed, website posting live, call center staffed with a reviewed script, twenty-four months of credit monitoring offered to the 31,000 whose card data was involved and twelve months to the remainder. Attorney general notifications filed. Consumer reporting agencies notified.

Day twenty-two. First class action filed. Second within a week. Both plead negligence, implied contract, and state consumer protection claims, and both name the legacy checkout flow — which the company had known was unpatched.

The lesson. Nothing in the response was wrong. The exposure was created eleven days before discovery, and, more fundamentally, by retaining 2021 card data in 2026 for a checkout flow that no longer existed.

When the breach is your vendor's

A large and growing share of incidents originate with a third party — a payroll processor, a file transfer product, a marketing platform, a claims administrator. The legal position is uncomfortable: the company that suffered no intrusion nonetheless owes the notification obligation to its own customers, because the obligation runs to the entity that owns the relationship with the affected individuals.

The roles. Most state statutes distinguish between an entity that owns or licenses the information, which must notify individuals, and one that maintains it on another's behalf, which must notify the owner. Under HIPAA the parallel distinction is covered entity and business associate. Under the GDPR it is controller and processor. Determine which role each party occupies before anyone communicates anything.

The immediate problems. The vendor controls the forensic evidence, and the company is dependent on the vendor's investigation and its willingness to share results. Vendors under pressure tend toward minimal disclosure, delayed disclosure, and characterizations that serve their own litigation posture. Meanwhile the company's own notification clock is running from its discovery, and "our vendor has not finished investigating" is not a recognized excuse under any statute.

What the contract should have said. Notification to the company within twenty-four or forty-eight hours of the vendor's discovery — meaningfully shorter than the company's own obligations. An obligation to cooperate, to provide forensic findings, and to preserve evidence. The right to participate in or conduct an independent investigation. Allocation of notification and credit monitoring costs. Indemnification that survives termination and is not capped at fees paid, which is the cap vendors propose and which is worthless against a nationwide notification. Audit rights and security requirements referencing a named framework rather than "commercially reasonable" measures.

What to do when the contract does not say that. Escalate to the vendor's executives immediately and in writing. Assert the notification deadline as the company's own legal obligation and ask specifically for the data elements and affected-individual list, which is what the notice requires. Preserve every communication. Tender to the cyber insurer, which may cover the notification costs regardless of fault. And begin the notification analysis on the facts available, because the deadline does not wait for the vendor.

Afterward. Repaper the agreement, and use the incident to run the same review across the vendor population. The most valuable output of a vendor breach is usually the list of other vendors holding the same data under the same inadequate terms.

What "reasonable security" means in practice

Nearly every enforcement theory and every negligence claim turns on whether the company's security was reasonable. No statute defines it, and the answer is assembled from several sources that practitioners should be able to name.

Recognized frameworks. The NIST Cybersecurity Framework and NIST SP 800-53, the CIS Critical Security Controls, and ISO/IEC 27001. Several state statutes and the NYDFS regulation reference them, and a number of states — Ohio's Data Protection Act is the model — provide an affirmative defense to a data breach tort claim for a company that maintained a program conforming to a named framework. That safe harbor is genuinely valuable and underused.

Sector rules. The HIPAA Security Rule's administrative, physical, and technical safeguards; the Safeguards Rule's enumerated elements including multi-factor authentication, encryption, and a qualified individual to oversee the program; and PCI DSS, which is contractual rather than legal but is treated by regulators and plaintiffs as evidence of the standard.

FTC consent orders. The most practical source. Two decades of orders describe, in operative detail, what the Commission considers deficient: default credentials, unpatched known vulnerabilities, absent multi-factor authentication on remote access, unsegmented networks, unencrypted sensitive data at rest, no logging or monitoring, no vendor oversight, and retention of data past any business need. Read as a body, they are a checklist.

What appears in every complaint. Failure to patch a known vulnerability with a published exploit. No multi-factor authentication on VPN or administrative accounts. Excessive retention. Overbroad access privileges. No network segmentation, so a foothold in one system reached everything. No monitoring, so dwell time ran to months. A prior warning — an internal audit, a penetration test, or a security team escalation — that was documented and not acted on.

That last item deserves emphasis. The single most damaging document in breach litigation is an internal assessment identifying the exact weakness that was exploited, dated well before the incident, with no record of remediation. Findings must be tracked to closure or formally accepted as risk, in writing, by someone with authority to accept it. An organization that generates findings and does nothing with them has manufactured the plaintiff's case.

The reasonable position is not perfect security, which does not exist and which no standard requires. It is a documented program mapped to a recognized framework, proportionate to the sensitivity of the data, tested, and demonstrably maintained — with the gaps identified, prioritized, and either fixed or consciously accepted.

Business email compromise, and why it is different

The most common incident by count is not a network intrusion. It is a mailbox.

An attacker obtains credentials through phishing, logs into a cloud email account, sets a forwarding rule, watches for an invoice or a wire instruction, and inserts substitute payment details at the right moment. The money leaves. There is no malware, no encryption event, and frequently no indication anything happened until a vendor asks why they were not paid.

The notification question is genuinely hard. A compromised mailbox may contain years of correspondence, attachments, and forms containing exactly the data elements the statutes cover — Social Security numbers in an HR message, account numbers in a customer email, health information in a benefits thread. Determining what was acquired requires reviewing the mailbox contents, which for a busy executive can mean hundreds of thousands of messages.

The practical approach is a data mining review of the mailbox by a vendor that specializes in it, extracting covered data elements and mapping them to individuals. This is expensive, slow, and frequently the largest single cost of the incident. It is also usually unavoidable, because "we cannot determine what was in the mailbox" is not a defensible basis for declining to notify.

Mitigating factors that may support a risk-of-harm determination where the state permits one: evidence that the attacker's activity was confined to a narrow window and to specific threads consistent with a payment fraud objective; forwarding rules limited to particular senders; and no evidence of bulk export. Document the analysis contemporaneously.

The money. Report to the FBI's Internet Crime Complaint Center immediately — the Financial Fraud Kill Chain can sometimes recover funds transferred within seventy-two hours, and the window is genuinely that short. Notify both banks. Where the loss falls between two innocent parties, the allocation is a UCC Article 4A question turning on the security procedure in the funds transfer agreement, and the party that ignored a verification step usually bears it.

Prevention costs almost nothing. Multi-factor authentication on all email accounts, disabling legacy authentication protocols that bypass it, alerting on new forwarding rules, and an out-of-band verbal verification requirement — using a phone number from the vendor file rather than from the email — for any change to payment instructions. Every organization believes it has this control. Most do not enforce it.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. Breach notification requirements differ in every state and change frequently, and federal sectoral rules — including CIRCIA's implementing regulation — have shifting effective dates. Notification deadlines run from discovery and are short. Engage outside counsel before retaining a forensic firm, and consult qualified counsel in every jurisdiction where affected individuals reside before issuing any notice.