“Cybercrimes” have increasingly drawn the attention of corporate counsel. However, the attention is usually directed at their companies’ own liabilities arising from the hacking of computer systems (e.g., government investigations and class actions). It is usually not directed at pursuing civil claims for relief against the “hackers.”
Undoubtedly, one important way to deal with a data breach is to prevent it from happening in the first place by: (1) defining roles, responsibilities and oversight for data security at the company; (2) conducting regular risk assessments; (3) implementing and regularly updating security measures, privacy and third-party vendor monitoring policies, and crisis response, corrective action and incident reporting plans; and (4) obtaining cyberinsurance (which may provide pre-breach risk management services and post-breach response services to help manage an incident).
