California law (Civil Code §1798.82) requires businesses to notify affected California residents within a reasonable time after discovering a breach of certain categories of personal information. Depending on the nature of the breach and the information involved, federal notifications (e.g., HIPAA, FTC) and notifications to the California Attorney General may also be required.

The CCPA (as amended by the CPRA) gives California residents rights over their personal information and imposes obligations on covered businesses regarding data collection, use, and disclosure. Businesses that fail to implement reasonable security measures and suffer a breach exposing personal information may be subject to statutory damages of $100–$750 per consumer per incident under the CCPA's private right of action.

Immediate steps include containing the incident to prevent further damage, preserving logs and forensic evidence, notifying legal counsel, evaluating notification obligations and their deadlines, retaining a qualified incident response firm, and reviewing applicable cyber insurance coverage. Prompt coordination between legal, technical, and executive stakeholders is critical.

Engaging an attorney to direct the cybersecurity investigation and incident response can allow communications and investigative findings to be protected by attorney-client privilege. Retaining technical forensic experts through legal counsel — rather than directly — can help preserve these protections and reduce the risk that investigation findings become discoverable in subsequent litigation.

Cyber liability policies typically cover first-party costs (breach notification, forensic investigation, business interruption, ransomware response) and third-party claims (lawsuits by affected individuals or regulatory actions). Coverage terms, exclusions, and sublimits vary significantly by policy. An attorney can help evaluate coverage and maximize recovery following an incident.

Ransomware raises legal questions around whether payment is permitted under OFAC sanctions regulations, whether the incident triggers data breach notification obligations, and how to preserve forensic evidence while managing business continuity pressures. Legal counsel should be involved before any ransom payment is made or refused.

Yes. Businesses that fail to implement reasonable security measures can face liability under the CCPA, common law negligence, or breach of contract theories if a cybersecurity incident results in the compromise of customer, employee, or third-party personal information. The reasonableness standard considers the nature of the data held and accepted industry security practices.

Compliance with the CCPA and CPRA (including having an updated privacy policy, honoring consumer rights requests, limiting data collection, implementing data security measures, and executing required vendor contracts) can reduce the risk of regulatory action and class litigation following a breach, and demonstrates that the business took reasonable steps to protect personal information.