Cyberattacks are creating a new litigation battleground, as more courts find that employers have a common-law duty to safeguard employees’ sensitive information.

Duty of care is often thought of in the physical context, where employers are legally bound to mitigate foreseeable risks to employee health and safety. But a ruling out of Georgia last month illustrates how that definition is evolving for the digital age.