What Should You Do When You're Hit by a Cyberattack?

• Pages: 2-3
• Date: 01 July 2022
• Author: John M. McNichols
• Subject Matter: Civil Law

By John M. McN ichols, Litigatio n News Associate Editor

What Should You Do When You’re

Hit by a Cyberattack?

data breach within three days. If passed by the House of

Representatives, the act will complement existing state statu-

tory law governing responses to cyberattacks and align

federal law with European law under the General Data

Protection Regulation (GDPR).

What Is a Cyberat tack or Data Bre ach?

A cyberattack is broadly dened as any attempt to gain

unauthorized access to someone else’s computer network

to manipulate the information housed there. Although the

word “cyberattack” is of recent vintage, Americans’ popular

awareness of electronic intrusion dates at least to the 1983

lm WarGames, in which a teenage hacker inadvertently pen-

etrates a U.S. military base and nearly starts World War III.

Real-world cyberattacks are less dramatic, but neverthe-

less consequential. A hacker who obtains access to another’s

information can use it for his or her own purposes—as intel-

ligence, for example—or to deprive the owner of its use

through “ransomware.” Inltration methods can take many

forms, the most well-known of which is the “phishing” email,

which lures the recipient to click on a hyperlink that will

allow the email’s sender to access the recipient’s system.

The most common consequence of a successful cyberattack

is a data breach, which occurs when hackers obtain and then

© Getty Image s

rompted by the Russian invasion of Ukraine, the

Biden administration recently warned of “evolv-

ing intelligence,” that the Russian government was

exploring options for potential cyberattacks against

the United States. While U.S. military departments and

federal intelligence agencies might seem the most likely tar-

gets for such attacks, the president made clear that no one

is immune and that attacks on certain private businesses—

banks, for example—could be just as damaging to U.S. infra-

structure as an attack on its military. Accordingly, he urged

all private companies, large and small, to harden their cyber

defenses by implementing the “best practices” of the “Shields

Up!” initiative of the federal Cybersecurity and Infrastructure

Security Agency.

Left unanswered, however, is an important question: What

happens if a company, despite taking all reasonable precau-

tions, nds itself the victim of a cyberattack that puts at risk

not merely the company’s own private data but that of its

customers as well? At present, there is no generally applicable

federal law requiring private companies to report such events

so that affected persons can take protective measures.

That may change, however, and soon. In March 2022, the

U.S. Senate passed the Strengthening American Cybersecurity

Act, which would require that private companies report a

2 | LITIGATION SECTIO N

Published in Litigation News Volume 47, Number 4, Summer 2022. © 2022 b y the American Bar Ass ociation. Reproduc ed with permission. A ll rights reserv ed. This information or an y portion there of may not be copied or dis seminated in any

form or by any means or sto red in an electronic da tabase or retrieval sy stem without the ex press writt en consent of the Amer ican Bar Associatio n.

TECHNOLOGY