The legal steps after a cyberattack depend on what happened, whose information may be involved, where affected people live, and which laws and contracts apply. A system outage does not automatically mean personal data was exposed. But a business may have reporting duties before it has a complete picture of the incident.
The steps below offer a practical starting point, with examples from U.S. and EU rules. Deadlines and requirements vary; have qualified counsel check the rules for your organization and each affected jurisdiction.
Legal Steps After a Cyberattack: What Businesses Should Do
The legal steps after a cyberattack depend on the data involved, affected locations, industry rules, and contracts. These actions help businesses preserve evidence, assess duties, notify partners, and document decisions.
1. Activate the response team and contact counsel
Use the company’s incident response plan. Bring together the people responsible for legal, technical, privacy, communications, and business decisions. A smaller organization may need outside counsel or an incident response firm to fill gaps.
Contact a lawyer experienced in privacy or cybersecurity incidents early. Counsel can help identify potential duties and coordinate the investigation. But involving a lawyer does not automatically make every report or conversation privileged. Ask how sensitive communications should be handled.
One of the first legal steps after a cyberattack is to make roles clear: who approves external statements, who tracks deadlines, and who can authorize urgent spending. Confusion over authority can slow containment and lead to inconsistent messages.
2. Preserve evidence and keep a timeline
Before wiping or rebuilding affected systems, coordinate with technical responders to preserve relevant logs, emails, access records, ransom messages, and system images. Record what was collected, by whom, when, and where it was stored. CISA advises preserving volatile evidence, including system memory and logs that may be lost or altered.
Keep a timeline of what the company learned and what it did in response. Mark uncertain findings as preliminary. Do not rewrite early notes later to make them sound more certain than they were.
3. Establish what was affected
Find out which systems were accessed, disrupted, encrypted, or potentially used to copy or alter information. Identify the data involved: customer records, employee files, payment details, health information, credentials, or confidential business material. Establish whose information it was and where those people are located.
Be precise about uncertainty. “We have not found evidence of access” is different from “the attacker did not access data.” That distinction may matter when counsel assesses the legal steps after a cyberattack, including whether a notice is required.
4. Map the rules and deadlines
Build a checklist based on the locations of affected people, the company’s activities, its industry, and the information involved. U.S. state breach-notification laws vary. Federal rules may apply to particular sectors. One deadline should never be treated as a universal rule.
For organizations subject to the EU’s General Data Protection Regulation (GDPR), a controller generally must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach—unless the breach is unlikely to create a risk to people’s rights and freedoms. A processor must notify its controller without undue delay.
Track each possible duty, its trigger, deadline, recipient, and owner. The legal steps after a cyberattack should follow the rule that applies to the organization and affected people, not a deadline borrowed from another country or sector.
5. Assess regulator and government reporting
Check whether the incident must be reported to a privacy authority, sector regulator, or other government agency. The answer depends on the organization and the event.
For instance, certain financial institutions covered by the FTC Safeguards Rule must report a qualifying event involving at least 500 consumers’ unencrypted information to the FTC as soon as possible, and no later than 30 days after discovery. That is a limited requirement, not a deadline for every business.
Public companies should assess whether the incident is material under SEC rules. A material cybersecurity incident generally must be disclosed on Form 8-K within four business days after the company determines it is material. The clock does not automatically start on the discovery date.
If the company is covered by HIPAA, breach duties for unsecured protected health information may also apply. For affected individuals, the outer limit is generally 60 days after discovery; reporting to HHS follows different timing for incidents affecting fewer than 500 people.
Document why the company decided a report was or was not required, then revisit that decision when new facts emerge.
6. Decide whether people must be notified
Determine whether customers, workers, patients, or other individuals need notice under applicable law or contract. Under the GDPR, people must be told without undue delay when a personal data breach is likely to result in a high risk to their rights and freedoms. The communication should explain the breach in clear language and provide relevant protective steps.
If notice is required, tell people what is known, what information may be involved, what the company is doing, and how they can get help. Avoid unsupported reassurance. If the investigation is still underway, say what remains uncertain and explain how updates will be provided. Among the legal steps after a cyberattack, a careful notice can help people act without overstating what the company knows.
7. Review contracts and notify business partners
Check customer agreements, data-processing terms, vendor contracts, and industry requirements for incident-reporting clauses. They may set a deadline or require cooperation, evidence preservation, or specific remediation.
A vendor handling data for another organization may need to notify that organization so it can assess its own duties. Keep copies of notices and a record of when they were sent. Coordinate messages where practical, but do not let coordination cause a missed deadline.
8. Consider reporting to law enforcement
A business can report suspected criminal activity to relevant law enforcement. In the United States, the FBI’s Internet Crime Complaint Center accepts reports about cyber-enabled crime, including ransomware. The FBI encourages reporting and does not support paying a ransom.
Reporting does not replace notice to customers, regulators, or contractual partners. Keep a copy of what was submitted. If law enforcement asks for a delay, confirm with counsel which rules permit it and whether the request affects each deadline. Reporting is one of the legal steps after a cyberattack that should be considered alongside—not instead of—other duties.
9. Notify the insurer and check policy conditions
Review the cyber insurance policy and contact the insurer or broker as soon as the policy requires. The policy may specify approved counsel, forensic firms, or procedures for authorizing response costs. Using an unapproved provider can complicate a claim, so check before committing to significant expenses when time allows.
Save notices, approvals, invoices, and insurer communications with the incident records. Coverage depends on the policy’s terms, exclusions, and circumstances. Insurance does not take the place of a required legal notice.
10. Track remediation and follow-up
Record the steps taken to secure systems and reduce the chance of another incident. That may include resetting credentials, closing exposed access, reviewing vendor permissions, or validating backups before restoration. Assign an owner and deadline to every follow-up action.
Keep track of complaints, regulator inquiries, claims, and commitments made in breach notices. If litigation or a formal investigation is anticipated, ask counsel which records to preserve and for how long. The legal steps after a cyberattack include a candid review of what worked, what failed, and which response procedures need to change.
Final Thoughts
Start with counsel, evidence preservation, and a reliable timeline. Then assess each law, contract, and affected group separately; notification deadlines are not interchangeable. For an active incident, have qualified counsel verify requirements in every relevant jurisdiction before relying on a general guide.
Frequently Asked Questions (FAQs) About Legal Steps After a Cyberattack
Does every cyberattack require customer notification?
No. A cyberattack does not automatically mean personal data was exposed or that customer notice is required. The company must assess the information involved, who may be affected, and the laws and contracts that apply.
Is the GDPR’s 72-hour deadline a general rule for every business?
No. It applies to controllers subject to the GDPR when a personal data breach is not unlikely to create a risk to people’s rights and freedoms. Other rules use different triggers and deadlines.
Should a business report ransomware to law enforcement?
It can report the incident to relevant authorities. Reporting does not replace other legal or contractual notices, and the response team should preserve evidence.
