1. What Cybersecurity Law Covers and How Criminal and Civil Liability Operate in Parallel
Cybersecurity law is not a single statute but a body of overlapping criminal, civil, and regulatory frameworks that each apply different standards, reach different defendants, and produce different consequences from the same underlying cyberattack.
The criminal dimension targets the attacker. The civil dimension targets the company that failed to protect the affected data. The regulatory dimension targets the company's compliance failures that preceded the attack. All three can proceed simultaneously, and a company that is managing an active criminal investigation into an attack on its systems while also defending a class action from affected customers and a regulatory inquiry from the FTC is facing the full spectrum of cybersecurity law exposure from a single incident.
The company's legal position in all three proceedings is shaped significantly by decisions made before the attack: what security program was in place, what employee training existed, what vendor agreements contained, and how the incident response plan was structured. An attorney who handles cybersecurity legal consulting and cybersecurity governance matters can evaluate the company's pre-attack legal exposure and identify which gaps in the security program create the most significant liability risk.
How the Cfaa Creates Both Criminal and Civil Liability for Unauthorized Computer Access
The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, is the primary federal statute governing unauthorized access to computer systems, and it creates both criminal liability for attackers and a civil cause of action for companies whose systems were accessed without authorization.
The CFAA prohibits accessing a computer without authorization or exceeding authorized access to obtain information, cause damage, or commit fraud, with criminal penalties ranging from one year in prison for simple unauthorized access to twenty years for attacks that cause serious bodily injury or death. The civil cause of action under 18 U.S.C. § 1030(g) allows companies that suffer losses exceeding five thousand dollars from a CFAA violation to sue the attacker for compensatory damages, injunctive relief, and other equitable remedies, without waiting for a criminal prosecution to proceed.
The CFAA's authorization requirement has been significantly narrowed by the Supreme Court's 2021 decision in Van Buren v. United States, 593 U.S. 374 (2021), which held that a person exceeds authorized access only when they access information on a computer system they are not entitled to access, not when they use information they are legitimately authorized to access for an improper purpose. The Van Buren ruling limits both criminal prosecutions and civil CFAA claims against insiders who misuse data they are technically authorized to access. An attorney who handles The Computer Fraud and Abuse Act (CFAA) and cybercrime and digital fraud matters can evaluate whether a specific insider threat or external attack satisfies the post-Van Buren authorization standard.
| Legal Framework | Who It Targets | Standard | Primary Consequence |
|---|---|---|---|
| CFAA criminal (18 U.S.C. § 1030) | Attackers, unauthorized accessors | Proof beyond a reasonable doubt | Up to 20 years federal prison |
| CFAA civil (18 U.S.C. § 1030(g)) | Attackers with losses over $5,000 | Preponderance of evidence | Compensatory damages, injunction |
| Data breach class action | Companies with inadequate security | Negligence or statutory violation | Money damages, injunctive relief |
| OFAC ransomware sanctions | Companies paying designated threat actors | Strict liability | Civil penalties up to $1.3 million per violation |
2. How Cybersecurity Law Governs Ransomware Payments and Sanctions Exposure
Ransomware attacks present a cybersecurity law problem that most companies do not anticipate: paying the ransom to recover encrypted data may itself be a federal sanctions violation that carries strict liability penalties regardless of whether the company knew it was paying a sanctioned entity.
OFAC's cyber-related sanctions programs designate specific ransomware threat actors, cryptocurrency wallets, and cryptocurrency exchanges as Specially Designated Nationals, and the sanctions regulations prohibit any U.S. .erson from engaging in transactions with a designated party. A company that pays a ransomware demand to a designated threat actor has violated the sanctions regulations regardless of whether it knew the recipient was designated, because OFAC applies strict liability to sanctions violations that does not require proof of intent. Civil penalties for each violation can reach the greater of approximately one million dollars or twice the value of the transaction.
OFAC's 2020 and 2021 advisories on ransomware specifically addressed the sanctions exposure that ransomware victims face, noting that companies with strong cybersecurity programs, prompt reporting to law enforcement, and voluntary disclosure to OFAC before making any payment receive favorable consideration in the enforcement calculus. The practical consequence is that the legal analysis of whether to pay a ransom must include an OFAC sanctions screening of the threat actor and available cryptocurrency wallets before any payment is made, which requires cybersecurity expertise and legal guidance that most incident response plans did not contemplate before the attack.
How the Stored Communications Act Governs Law Enforcement Access to Digital Data
The Stored Communications Act, 18 U.S.C. § 2701 et seq., governs law enforcement access to emails, stored files, and other electronic communications held by third-party service providers, and it determines what data the government can obtain from cloud providers, email services, and other digital custodians without the account holder's consent.
The SCA requires the government to obtain either a search warrant supported by probable cause or a court order meeting a lower standard depending on the age and type of the stored communication. Real-time interception of communications requires compliance with the Wiretap Act under 18 U.S.C. § 2511, which has stricter requirements than the SCA's stored communications provisions. The distinction between stored and intercepted communications, and between content and non-content data such as metadata and subscriber information, determines which legal standard the government must satisfy to obtain each category of digital evidence.
Companies subject to government cybersecurity investigations must understand which data the government can access without their consent through SCA process directed at their cloud providers, and which data requires a warrant directed at the company itself. An attorney who handles data breach and government cybersecurity investigation matters can evaluate what legal process the government has used or intends to use and whether any production challenges are available under the applicable statutes.
Critical infrastructure operators face cybersecurity law obligations that go beyond the frameworks applicable to commercial companies, including mandatory incident reporting to CISA under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 within 72 hours of discovering a covered incident and within 24 hours of making a ransomware payment, and sector-specific requirements from the Transportation Security Administration, the Nuclear Regulatory Commission, and the Federal Energy Regulatory Commission that impose their own cybersecurity standards on top of the general federal framework.
3. How Cybersecurity Law Holds Boards and Executives Liable for Security Failures
Board and executive liability for cybersecurity failures has expanded significantly as courts, regulators, and investors have applied established legal doctrines to the specific context of corporate cybersecurity governance, and the personal exposure created by a major cyberattack now extends well beyond the IT department.
The SEC's 2023 cybersecurity disclosure rules require public companies to describe their board's oversight role in cybersecurity risk management and to disclose material cybersecurity incidents within four business days of a materiality determination. A board that discloses robust cybersecurity oversight in its annual report and then demonstrates no actual engagement with the company's security program when an incident occurs has created the basis for a securities fraud claim based on the gap between the disclosed oversight and the actual absence of it. The same materiality analysis that governs financial disclosures applies to cybersecurity disclosures, meaning a material cyberattack that is disclosed late or incompletely produces the same securities enforcement exposure as a late or incomplete financial restatement.
Delaware's Caremark doctrine, applied to cybersecurity by the Court of Chancery in In re SolarWinds Corp. Derivative Litigation and similar cases, holds that directors breach their duty of oversight when they utterly fail to implement a board-level information system for monitoring mission-critical risks including cybersecurity. A board that received no information about the company's security program, response capabilities, or known vulnerabilities before a major breach occurred cannot demonstrate the meaningful engagement that Caremark requires. An attorney who handles enterprise cybersecurity and board liability matters can evaluate whether the board's current cybersecurity oversight structure satisfies both the SEC disclosure standard and the Caremark duty of oversight.
How Data Breach Class Action Litigation Follows a Cyberattack
A data breach affecting consumer personal information predictably triggers class action litigation within weeks, because plaintiffs' firms monitor publicly disclosed incidents and file complaints based on breach notification letters, regulatory filings, and news reports before the company has completed its own forensic investigation.
Data breach class actions assert multiple legal theories simultaneously: negligence for failing to implement reasonable security measures, breach of implied contract for failing to protect data as implicitly promised when the company collected it, unjust enrichment for profiting from data collection without adequately protecting the data, and statutory claims under applicable state breach notification laws and consumer protection statutes. The standing question, whether affected individuals have suffered sufficient injury to bring a federal claim, has been actively litigated in data breach cases, with courts varying significantly on whether the risk of future identity theft, the time spent monitoring accounts, and the diminished value of compromised personal information constitute sufficient injury.
Certification of a class in a data breach case requires that the plaintiffs satisfy Rule 23's commonality, typicality, and predominance requirements, which turn on whether the breach affected all class members in the same way and whether common questions of law and fact predominate over individual ones. A company that can demonstrate that different class members were affected by different data elements, that the breach affected different populations differently, or that causation varies among affected individuals has arguments against class certification that can limit the case's settlement value significantly. An attorney who handles data breach litigation and mass data breach litigation matters can evaluate the class certification arguments and develop the discovery strategy that best supports challenging commonality and predominance.
International cybersecurity law creates a separate layer of exposure for companies with European operations. The EU's NIS2 Directive requires operators of essential services and digital service providers to implement specific security measures and to notify competent authorities within 24 hours of becoming aware of a significant incident, with full incident reports required within 72 hours. The General Data Protection Regulation's breach notification requirement runs parallel to NIS2, requiring notification to supervisory authorities within 72 hours and to affected data subjects without undue delay when the breach poses high risk. GDPR violations carry penalties of up to four percent of global annual turnover, making an EU data breach significantly more expensive than a purely domestic incident of equivalent scale. An attorney who handles GDPR and international cybersecurity matters can coordinate U.S. and EU notification obligations simultaneously.
4. Frequently Asked Questions about Cybersecurity Law
Cybersecurity law questions arrive from companies managing a live incident, from executives who received board-level inquiries after a breach was disclosed, and from in-house counsel evaluating criminal cooperation obligations alongside civil defense. The questions that define those situations most immediately are answered here.
What Is the Computer Fraud and Abuse Act and Who Does It Apply to?
The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, is the primary federal statute criminalizing unauthorized access to computer systems, covering conduct including hacking, introducing malicious code, and fraudulent use of computers affecting interstate commerce. It applies to external attackers who breach a company's systems and in some cases to insiders who access data beyond their authorization. The CFAA creates both criminal liability with penalties up to 20 years imprisonment for severe violations and a civil cause of action for companies suffering losses exceeding five thousand dollars. The Supreme Court's 2021 decision in Van Buren v. United States narrowed the statute's scope by limiting liability to access of information the person was not authorized to access at all.
Does Paying a Ransomware Demand Violate Federal Law?
Potentially yes. OFAC's cyber-related sanctions programs designate specific ransomware threat actors and cryptocurrency infrastructure as Specially Designated Nationals, and paying a ransom to a designated entity violates federal sanctions regulations under strict liability, meaning intent to pay a sanctioned entity is not required for liability. Civil penalties can reach approximately one million dollars or twice the transaction value per violation. Companies that promptly report to law enforcement, conduct an OFAC sanctions screening of the threat actor before paying, and voluntarily disclose any potential sanctions issue to OFAC receive significantly more favorable treatment in any subsequent enforcement proceeding. An attorney who handles cybersecurity law and OFAC sanctions matters can conduct the pre-payment screening and manage the disclosure process.
When Does a Board of Directors Face Personal Liability for a Cyberattack?
Board members face personal liability under Delaware's Caremark doctrine when they utterly fail to implement a board-level reporting system for cybersecurity risks that are material to the company's operations, because that failure constitutes a breach of the duty of oversight. They face securities law liability when the company made materially misleading statements about its cybersecurity program or incident response in public disclosures, including the SEC's required cybersecurity risk and incident disclosures. The combination of these two theories, Caremark for governance failure and securities law for disclosure failure, is the most common board-level exposure following a significant breach. An attorney who handles court-ordered cybersecurity measures and board liability matters can evaluate whether existing board oversight practices satisfy both standards.
How Do Data Breach Class Actions Work and What Determines Their Outcome?
Data breach class actions are filed by plaintiffs' law firms within weeks of a publicly disclosed incident, asserting negligence, breach of implied contract, and statutory violations on behalf of all individuals whose personal information was exposed. The key legal battlegrounds are standing, whether affected individuals suffered sufficient injury under Article III to bring a federal claim, and class certification, whether common questions of law and fact predominate over individual ones. Companies that can demonstrate that different affected individuals were harmed differently, that causation varies across the class, or that the damages calculation requires individualized inquiry have arguments against certification that significantly reduce the case's settlement value. An attorney who handles data privacy class action and data breach defense matters can develop those arguments from the earliest stages of the litigation.
What Cybersecurity Law Obligations Apply to Companies with European Operations?
Companies with European operations face cybersecurity law requirements under two parallel EU frameworks. The NIS2 Directive requires operators of essential services and digital service providers to implement defined security measures and report significant incidents to competent authorities within 24 hours of awareness, with full reports within 72 hours. The GDPR requires notification to supervisory authorities within 72 hours of discovering a personal data breach and notification to affected individuals without undue delay when the breach poses high risk to their rights and freedoms. GDPR violations carry penalties up to four percent of global annual turnover. Both frameworks apply simultaneously, requiring coordinated U.S. .nd EU notification processes from the moment a breach is detected. An attorney who handles GDPR and data privacy litigation matters can manage the dual-track notification process.
29 May, 2026
