Defining a "Data Breach"

If a hacker gets into your company's network, have you had a data breach? Legally, not necessarily, and the answer can decide whether regulators and customers must be notified on tight deadlines.

In this TalksOnLaw Brief, Michelle Reed, a partner at Paul Hastings and co-chair of its Data Privacy and Cybersecurity practice, explains how lawyers decide when a cybersecurity incident becomes a legal data breach.

Incident or Breach?

Reed notes that people often use “breach” loosely to mean someone got into a system. She prefers the term security incident, and she does not classify an event as a data breach until she determines that personal data of specific individuals in specific jurisdictions was affected. The distinction matters because once regulated personal data is implicated, notification clocks start running for regulators such as state attorneys general. Some companies face thousands of incidents but very few breaches, she says, which is why layered controls matter. Organizations need to know what their crown jewels are and where they sit, whether consumer, investor, or employee data, trade secrets, or trading algorithms, so an intruder who gets in one place cannot travel to another. She recalls a breach in which a help desk issued the same reset password to many employees, but notes that most recent breaches she has seen have been highly sophisticated rather than sloppy.

It Depends on the Data and the Industry

Whether exposure of limited information counts depends on the industry. For a hospital, even a list of patients is protected health information, though HIPAA's four-factor risk assessment can allow a covered entity to avoid notification by showing a low probability that the information was compromised. Investment advisers and other firms subject to the Gramm-Leach-Bliley Act face a broad definition of nonpublic personal information that can include the mere fact that someone is an investor in a fund, although notice is usually not required unless more sensitive information is involved. Reed also anticipated SEC rules that would be broader than state law definitions.

Access Versus Exfiltration

Another key question is whether an intruder only accessed data or actually took it. Some laws require the data to be taken before a notification obligation arises, while others treat access alone as sufficient. That creates practical puzzles, such as a share drive holding a terabyte of data that an intruder could reach for only five minutes. Reed's answer is that it depends on what was in the folder, which states are involved, and what business the company is in.

What to Know Now

Reed's framework remains how practitioners approach incidents, and the SEC rules she anticipated have arrived. In 2024 the SEC amended Regulation S-P to require broker-dealers, investment companies, registered investment advisers, and transfer agents to maintain incident response programs and to notify affected individuals as soon as practicable, and no later than 30 days, after becoming aware that sensitive customer information was or is reasonably likely to have been accessed or used without authorization. Larger firms had to comply by late 2025 and smaller firms by mid-2026. Public companies must also disclose material cybersecurity incidents on Form 8-K, generally within four business days of determining materiality, and the FTC's Safeguards Rule now requires covered non-bank financial institutions to notify the FTC of certain events involving at least 500 consumers. Every state still has its own breach notification law, so careful fact-finding about what data was affected remains the starting point.