Data Breaches & Cybersecurity

What counts as a data breach?

Legally, a breach usually means unauthorized access to, or acquisition of, protected personal information. Definitions differ by state. Texas, for example, defines a breach of system security as unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of sensitive personal information, and it counts encrypted data as covered if the person accessing it has the decryption key.

Not every security incident is a reportable breach. Organizations typically work through the same questions: what happened, which systems were affected, what information was involved, whether personal information was accessed, whether it was encrypted, whose residents are affected, and whether the applicable law has a risk-of-harm exception.

What kind of information triggers a notice?

Most laws start from a person’s name combined with a sensitive element: a Social Security number, a driver’s license or other government ID number, or a financial account or payment card number together with the code needed to use it.

Many states have widened the list to include medical and health insurance information, biometric identifiers and online account credentials such as a username and password. Properly encrypted data is often outside the trigger, but that protection usually disappears if the encryption key was exposed too. Because definitions keep growing, organizations maintain an inventory of where sensitive data sits.

How quickly must people be told?

It depends on the state. Older laws require notice in the most expedient time possible and without unreasonable delay. A growing number of states set fixed deadlines instead, commonly between 30 and 60 days.

California made that move. Since January 1, 2026, notice to affected residents is due within 30 calendar days of discovery or notification of the breach (SB 446). Delay is allowed only for the legitimate needs of law enforcement, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. See our breach notification library for the states profiled so far.

Does the attorney general or another regulator have to be told?

Often, above a size threshold. In California, if more than 500 residents must be notified about a single breach, a sample copy of the notice (without personal information) goes to the Attorney General within 15 calendar days of notifying consumers. In Texas, if a breach involves at least 250 residents, the Attorney General must be notified as soon as practicable and no later than the 30th day after the breach is determined, and the Attorney General keeps a public listing of reported breaches.

Other states use different thresholds, and some also require notice to consumer reporting agencies when many people are notified. Check each state’s statute: California, Texas.

What do federal rules add?

Several federal rules run their own clocks on top of the state laws, depending on the sector:

What if people in several states are affected?

Each state’s law protects its own residents, so one incident can trigger several laws at once, plus any federal sector rule. A company with customers in California, Texas and New York has to meet each state’s definition, deadline and regulator-notice rules for the residents of that state.

In practice many organizations plan around the strictest applicable deadline and build one response process that can satisfy all of them. With California at 30 days, an incident that touches California residents pulls the practical timeline forward for everyone else.

What should an organization do in the first 24 hours?

The early hours are uncertain, but the legal clock may already be running. Typical priorities:

• Activate the incident response team and inform leadership.
• Preserve evidence and contain the affected systems.
• Engage forensic specialists and legal counsel.
• Establish a preliminary scope: which data, and residents of which states.
• Record when the incident was discovered, since many deadlines count from that date.
• Check contracts and insurance policies for their own notice duties.
• Document decisions as they are made.

Premature conclusions can turn out wrong, while unnecessary delay increases regulatory risk. The aim is urgency with a disciplined investigation.

What should a breach notice say?

Plain language that covers what happened, what information was involved, what the organization has done, what people should do next and where to get help. California’s statute prescribes a model format titled “Notice of Data Breach” with set headings, and requires at least a general description of the incident and the date of the notice.

Overly technical text rarely reassures people, and vague statements undermine trust. Many organizations prepare templates before an incident so factual updates can go out quickly while the investigation continues.

What if the breach happened at a vendor?

The organization that collected the data usually still has notification duties, even if the vendor’s systems were hit. Many state laws also require a company that maintains data on someone else’s behalf to alert the data owner promptly.

Contracts therefore matter: security requirements, incident-notice timing, audit rights and cooperation duties. Organizations assess vendors before onboarding, monitor them over time and test how quickly incidents get reported to them.

I received a breach notice. What should I do?

• Read which information was involved. A leaked password calls for different steps than a leaked Social Security number.
• Change the affected password everywhere you reused it and turn on multi-factor authentication.
• Consider a credit freeze. Freezes are free under federal law. A fraud alert is another option.
• Check your account statements and credit reports for activity you do not recognize.
• Be careful with emails or texts that mention the breach. Criminals often follow up with phishing.
• If someone misuses your information, report it at IdentityTheft.gov and keep the notice for your records.

Can a company be fined or sued after a breach?

Possibly. State attorneys general enforce breach notification and data security laws, and sector regulators such as HHS and the FTC investigate in their own areas. A late or missing notice can be a violation on its own, separate from the breach itself.

Private lawsuits are possible in some situations. California’s CCPA, for example, gives consumers a limited right to sue over certain data breaches. Settlements with attorneys general can be large: the Daily Journal reports a $6.75 million California settlement in 2024 over a 2020 breach at a software company.

How does cybersecurity governance fit in?

Notification is only one piece. Regulators increasingly ask whether an organization had a working security program before the incident: risk assessments, access controls and multi-factor authentication, patching, encryption, backups, vendor management, staff training and tested response plans.

Some of this is now written into rules. The FTC Safeguards Rule requires covered financial firms to keep a written information security program, and public companies must describe their cybersecurity risk management, strategy and board oversight in annual reports (Regulation S-K Item 106). Boards of directors increasingly receive regular cyber briefings.

What is changing right now?

• California: fixed 30-day individual notice and a 15-day Attorney General sample copy since January 1, 2026.
• CIRCIA: the federal critical-infrastructure incident reporting rule is not yet final. Reporting from October 2026 says it has gone to White House review, with publication expected before the end of the year.
• HIPAA Security Rule: HHS proposed a major overhaul in January 2025. The target for the final rule has moved to July 2027, according to reporting.
• Threats: ransomware, AI-enabled attacks, supply-chain and vendor compromise, and identity-based attacks keep shaping what regulators expect.

Follow the Updates page for changes we record.