Companies are liable for data breaches in several distinct ways, and the exposure is real: affected individuals can sue for negligence or breach of contract, federal and state regulators can impose penalties that run into the millions, and failing to notify people after a breach creates its own separate liability. Whether a particular company is on the hook depends on what data was exposed, what security it had in place beforehand, and which federal and state laws reach the situation.
Lawsuits From the People Whose Data Was Exposed
The most common legal theory used against a company after a breach is negligence. A plaintiff has to prove four things: the company had a duty to protect the data it collected, the company failed to meet that duty by not implementing reasonable security, that failure caused the exposure, and the plaintiff suffered some harm as a result.
Duty is usually the easiest piece. When a company collects sensitive information like Social Security numbers, financial account details, or medical records, courts generally recognize an obligation to protect it. The harder question is what counts as reasonable security. Courts weigh industry standards, the sensitivity of the data, the size of the company, and the cost of available safeguards. A small business storing email addresses faces a different standard than a health insurer storing medical records.
Breach of duty is where most cases are won or lost. Plaintiffs have to show the company’s security fell below what a reasonable organization in its industry would have done. Common failures include not encrypting stored data, ignoring known software vulnerabilities, running outdated systems, or failing to train employees on phishing. A company doesn’t have to be perfect. It has to be reasonable.
Breach of Contract
A company’s privacy policy and terms of service function as a contract with the consumer. If the policy promises “industry-standard encryption” or “reasonable security measures” and a breach reveals it delivered neither, an affected consumer may have a breach-of-contract claim. This cuts both ways. Vague policies with heavy disclaimers give plaintiffs less to work with; specific, detailed security promises create specific, enforceable obligations. Courts have also recognized implied contracts in some cases, treating the act of collecting sensitive data as creating an unwritten expectation of reasonable protection.
The Standing Problem
Even when a company clearly failed to protect data, individuals suing in federal court have to demonstrate a concrete injury to have standing to bring the case at all.1Constitution Annotated. ArtIII.S2.C1.6.4.2 Concrete Injury
That is straightforward when stolen data leads to actual fraud, unauthorized charges, or drained bank accounts. It’s harder in the more common scenario, where data is stolen but no fraud has happened yet. The affected person faces an elevated risk of identity theft, but risk is not the same as injury.
The Supreme Court has addressed this twice. In Spokeo, Inc. v. Robins (2016), the Court held that an intangible injury can be concrete if it has a “close relationship” to a harm traditionally recognized in American courts.2Justia. Spokeo, Inc. v. Robins, 578 U.S. ___ (2016) Then in TransUnion LLC v. Ramirez (2021), the Court tightened the standard, ruling that the “mere risk of future harm, without more,” does not establish standing in a lawsuit seeking money damages.3Supreme Court of the United States. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)
In practice, courts now look closely at what was stolen. A breach exposing Social Security numbers and financial account information is more likely to support standing than one exposing only email addresses, because the first creates a substantial and imminent risk of identity theft that resembles traditional fraud harms.
Federal Regulatory Liability
Federal law goes after companies through several channels, some tied to specific industries and some that apply to almost any business collecting consumer data.
FTC Enforcement
The Federal Trade Commission is the most aggressive federal enforcer of data security, including for companies not covered by any industry-specific law. Its authority comes from Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices in commerce.4Office of the Law Revision Counsel. 15 USC 45 – Unfair Methods of Competition Unlawful
The FTC uses this authority two ways. If a company promises to safeguard consumer data and then fails to do so, the FTC treats that as a deceptive practice. Even without a broken promise, the FTC can pursue companies whose security is so inadequate that it causes substantial consumer injury, treating that as an unfair practice.5Federal Trade Commission. Privacy and Security Enforcement
FTC actions typically end in consent orders that impose specific security requirements for 20 years, with regular third-party audits. Violating a consent order triggers penalties of over $50,000 per violation.
HIPAA and Health Data
HIPAA’s Security Rule requires covered entities and their business associates to implement administrative, physical, and technical safeguards for electronic health information.6U.S. Department of Health and Human Services. The Security Rule
Civil penalties scale with culpability. As of 2026, violations where the entity didn’t know about the problem carry a maximum penalty of $73,011 per violation, with an annual cap of $2,190,294. Violations involving willful neglect that the entity fails to correct carry the same per-violation maximum, but every violation is penalized at the full amount with no lower floor.7Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
Criminal penalties apply when someone knowingly obtains or discloses protected health information in violation of HIPAA. The basic offense carries up to $50,000 in fines and one year in prison. Violations involving false pretenses raise the ceiling to $100,000 and five years. Violations committed with intent to sell health information or use it for personal gain or malicious harm can result in fines up to $250,000 and up to 10 years in prison.8GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
Gramm-Leach-Bliley for Financial Companies
The Gramm-Leach-Bliley Act requires financial institutions to safeguard customer financial data. It covers not just banks but also mortgage brokers, payday lenders, tax preparers, and debt collectors.9Federal Trade Commission. Gramm-Leach-Bliley Act The FTC’s Safeguards Rule, which implements GLBA for non-bank financial institutions, requires a comprehensive written information security program. When a breach involves at least 500 consumers, the company must notify the FTC as soon as possible and no later than 30 days after discovery.10eCFR. 16 CFR 314.4 – Elements
SEC Disclosure for Public Companies
Since late 2023, publicly traded companies have had to disclose any cybersecurity incident they determine to be material by filing a Form 8-K with the SEC within four business days of that determination. The filing describes the nature, scope, and timing of the incident and its material impact or reasonably likely impact on the company.11U.S. Securities and Exchange Commission. Public Company Cybersecurity Disclosures Final Rules – Fact Sheet The clock starts when the company determines the incident is material, but the SEC expects that determination “without unreasonable delay,” so stalling the assessment carries its own legal risk.
CIRCIA for Critical Infrastructure
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 requires operators of critical infrastructure to report covered cyber incidents to the Cybersecurity and Infrastructure Security Agency within 72 hours, and to report ransom payments within 24 hours.12Cybersecurity and Infrastructure Security Agency. Cyber Incident Reporting for Critical Infrastructure Act of 2022 The reporting clock starts when the entity reasonably believes a significant incident has occurred, not when the forensic investigation wraps up.
State Laws That Let Consumers Sue Directly
Where most federal laws generate regulatory penalties enforced by agencies, several state laws give individual consumers the right to sue companies. The clearest example is California’s Consumer Privacy Act, which lets consumers file a civil lawsuit when their unencrypted personal information is stolen because a business failed to maintain reasonable security.
The CCPA’s private right of action provides statutory damages between $100 and $750 per consumer per incident, or actual damages, whichever is greater. Consumers do not need to prove specific out-of-pocket losses to recover statutory damages. A breach affecting 10,000 consumers could generate exposure between $1 million and $7.5 million in statutory damages alone, before legal fees. Before suing for statutory damages, a consumer must give the company 30 days’ written notice and an opportunity to cure.
Other states have followed with their own comprehensive privacy laws, though most rely on enforcement by the state attorney general rather than a direct right to sue. Companies operating across state lines face a patchwork of obligations.
Notification Failures Create Their Own Liability
All 50 states, the District of Columbia, and U.S. territories have enacted laws requiring companies to notify affected individuals when their personal information is compromised.13National Conference of State Legislatures. Security Breach Notification Laws The details vary, but the structure is common: notice must go out without unreasonable delay, with many states setting a hard deadline of 30 or 60 days from discovery.
Notice generally has to describe what happened, what types of information were exposed, and what steps consumers can take to protect themselves. Many states also require notifying the state attorney general, particularly for breaches affecting a large number of residents.14National Association of Attorneys General. Data Breaches Some require notifying the major credit reporting agencies past a certain threshold.
HIPAA has its own version. Covered entities must notify affected individuals within 60 days of discovering a breach. Breaches affecting 500 or more people must be reported to the Department of Health and Human Services within the same 60 days; smaller breaches can be reported to HHS annually.15U.S. Department of Health and Human Services. Breach Notification Rule
Failing to comply with notification rules is a separate source of liability. State attorneys general can impose fines for late or missing notifications, and the failure can be used against the company in later litigation as evidence it didn’t take the breach seriously. Some states impose per-day penalties for each day notification is late.
Why Class Actions Multiply the Exposure
Most data breach litigation takes the form of class actions, where one or a handful of plaintiffs sue on behalf of everyone affected. That aggregation is what turns a breach from an individual nuisance into a company-threatening event. Statutory damages of $100 to $750 per person sound modest until multiplied across millions of affected consumers.
Major data breach class actions have produced settlements in the hundreds of millions of dollars. Even when individual payouts are small, the defense costs, settlement funds, and operational disruption add up. Companies typically face multiple class actions filed in different courts after a significant breach, which must be consolidated before litigation can proceed. Specialized plaintiffs’ firms monitor public breach disclosures and file suits within days.
Safe Harbor Defenses Some States Provide
A growing number of states have enacted cybersecurity safe harbor laws that give companies an affirmative defense against lawsuits claiming a lack of reasonable security. To qualify, a company must create, maintain, and actually follow a written cybersecurity program that conforms to a recognized industry framework. Frameworks that typically qualify include the NIST Cybersecurity Framework, the CIS Controls, the ISO 27000 series, and the HIPAA/HITECH security requirements for organizations handling health data.
The defense is not automatic. The company has to show it was actually following the program at the time of the breach, not that it adopted one afterward. These safe harbors also typically cover only tort claims like negligence. They generally do not shield a company from regulatory penalties or statutory claims under laws like the CCPA. For companies that invest in compliance, though, they provide meaningful protection against the most common category of post-breach lawsuits.