Cybersecurity: how to protect your company after an attack

What are a company's cybersecurity obligations and how can the legal consequences of an attack be managed?

At a time when digital transformation is accelerating, cyberattacks are multiplying and now affect every company, regardless of its size. Beyond the immediate technical and financial harm, these incidents expose organisations to considerable legal risks.

What are companies' cybersecurity obligations and how can the legal consequences of an attack be managed effectively? An analysis of the issues at stake and the strategies to implement.

If you would like to call on a lawyer specialising in IT litigation, contact me!

The legal framework for cybersecurity: growing obligations

In recent years, the regulatory framework governing IT security has become considerably denser. Companies now face a set of legal obligations, the disregard of which can result in severe penalties.

The GDPR (General Data Protection Regulation) forms the fundamental basis of these obligations in Europe. In particular, it requires the implementation of appropriate technical and organisational measures to ensure the security of personal data. In the event of a breach, the company must notify the supervisory authority within 72 hours and, in certain cases, inform the data subjects concerned.

For operators of vital importance (OIV) and operators of essential services (OSE), the NIS Directive (Network and Information Security) and its transposition into national law further reinforce these obligations, with specific requirements relating to the security of information systems and the notification of incidents.

The financial sector, which is particularly exposed, is subject to additional sector-specific regulations such as DORA (Digital Operational Resilience Act) at European level, which imposes high standards of digital operational resilience.

These various regulations create a complex landscape in which compliance is no longer an option but a strategic necessity, given how dissuasive the potential penalties are (up to 4% of worldwide turnover for the most serious GDPR breaches).

Post-incident legal risks: a threefold front

Following a cyberattack, a company may find its liability engaged on three distinct fronts:

Towards the regulatory authorities, which may impose administrative penalties in the event of a failure to meet security or notification obligations. The CNIL in France, or the other data protection authorities in Europe, hold considerable enforcement powers that they no longer hesitate to exercise.

Towards the individuals concerned by a data breach (customers, employees, suppliers), who may bring civil liability claims, either individually or collectively through class actions, to obtain compensation for the harm suffered.

Towards business partners, whose systems may have been compromised by knock-on effect or who may suffer losses as a result of the unavailability of services. Contracts generally contain security clauses, the breach of which may engage the company's contractual liability.

These legal risks translate into potentially very high financial costs, compounded by lasting reputational repercussions. According to several studies, the total cost of a major data breach can amount to several million euros for a mid-sized company.

Let's discuss your needs for 15 minutes!

Concrete cases of litigation following cyberattacks: precedents worth pondering

Several recent cases illustrate how the legal risks associated with cyberattacks can materialise:

In 2020, a major company in the hospitality sector was fined 20 million euros by a European data protection authority for failing to meet its security obligations, following an incident that exposed the personal data of several million customers.

A French financial institution was the subject of a class action brought by customers whose banking data had been compromised, resulting in an amicable settlement of several million euros in addition to the administrative penalties.

An industrial SME, the victim of ransomware, found its contractual liability engaged by its customers as a result of the prolonged interruption of its services, jeopardising its economic survival despite payment of the ransom.

These examples underscore the importance of proactive legal management of cybersecurity incidents. Faced with these challenges, the support of an IT litigation lawyer becomes a strategic asset for navigating the complexity of legal obligations and minimising the company's exposure.

Managing the legal crisis after an incident: a structured methodology

Faced with a confirmed cyberattack, implementing a structured methodology for managing the legal crisis is essential:

The initial assessment of the incident must determine its nature, scope and potential legal implications. This crucial step makes it possible to identify the applicable legal obligations (notification of the authorities, information of the individuals concerned) and the deadlines to be met.

The collection and preservation of evidence is of paramount importance in establishing the circumstances of the attack, identifying any potential liability and preparing for possible legal action. System logs, electronic communications and technical reports must be secured in accordance with protocols that guarantee their integrity.

The notification of the competent authorities must be carried out in compliance with the regulatory deadlines and must contain the required information without exposing the company to additional legal risks. Drafting these notifications is a delicate exercise that requires sharp legal expertise.

The external and internal crisis communication must be carefully calibrated to inform stakeholders without fuelling speculation or creating damaging admissions of liability. Messages must be validated by legal counsel before being released.

The handling of claims and compensation requests must be based on a thorough legal analysis of the grounds invoked and the harm alleged, in order to determine the most appropriate strategy (contestation, settlement, mediation).

These various steps must be coordinated within a multidisciplinary crisis unit bringing together executives, the CIO, the CISO, the DPO, in-house lawyers and external counsel, in order to ensure a coherent and effective approach.

I want reliable legal documents!

Defence strategies in the event of litigation

If, despite preventive measures, the company faces litigation arising from a cyberattack, several defence strategies may be considered:

The contestation of liability may be based on demonstrating the implementation of security measures that comply with the state of the art and are tailored to the risks, or on invoking force majeure if the attack is unforeseeable and irresistible in character (which is rarely accepted by the courts in cybersecurity matters).

A limitation of the compensable harm may be sought by disputing the direct causal link between the incident and certain alleged damages, or by invoking the fault of the victim who failed to take the necessary measures to limit their own loss.

The recourse against liable third parties, such as providers of defective security solutions or IT service providers who have been negligent, may make it possible to share the financial burden of any judgments handed down.

The triggering of cyber insurance policies is a major issue, requiring a thorough legal analysis of the coverage conditions and potential exclusions.

Implementing these strategies requires legal expertise capable of combining the technical aspects of cybersecurity with classic litigation issues.

Anticipate to defend better: essential preventive measures

The best legal defence remains prevention. Several measures can significantly reduce a company's legal exposure in the event of a cyberattack:

The mapping of the legal obligations applicable to the company according to its sector of activity, its size and the data processed makes it possible to identify precisely the requirements to be met.

The documentation of compliance through formalised security policies, incident management procedures and regular audit reports constitutes valuable evidence in the event of litigation.

The revision of contracts with IT service providers, cloud providers and other partners must incorporate robust security clauses and mechanisms for allocating responsibility in the event of an incident.

The regular running of incident simulations makes it possible to test the effectiveness of response procedures, including in their legal and communication dimensions.

Taking out cyber insurance tailored to the company's specific risks offers financial protection in the event of an incident, provided that the coverage is carefully negotiated to cover all relevant risks.

These preventive measures, implemented with the support of specialists, constitute a worthwhile investment in light of the potential costs of post-cyberattack litigation.

The legal approach: a pillar of cyber resilience

In a world where cyberattacks are becoming a matter of "when" rather than "if", the legal dimension of security incident management is establishing itself as an essential pillar of organisations' cyber resilience.

Beyond the technical aspects, a company's ability to navigate the complexity of the regulatory framework, to manage notification obligations effectively and to control litigation risks largely determines the ultimate impact of a cyberattack on its longevity.

Companies that integrate this legal dimension into their overall cybersecurity strategy, by surrounding themselves with the appropriate expertise, are better equipped to face the multidimensional consequences of an incident and to turn this ordeal into an opportunity to strengthen their practices.