Key points

• Retail incidents tend to start with a compromised third party, a stolen credential or an unpatched internet-facing system rather than a novel attack. Preparation matters more than prediction.
• The first 72 hours drive most of the legal outcome. Early decisions on privilege, forensics, regulator contact and public statements are hard to reverse.
• Notification duties overlap and run on different clocks: US state laws, the SEC disclosure rule for public companies, the GDPR 72-hour rule and payment card network contract terms.
• Regulators and plaintiffs look beyond the incident to the controls that existed before it. Records of what the board knew and what the company did are the best evidence.
• The strongest programs rehearse the response with legal, security, communications and operations in one room, and test vendor obligations before they are needed.

A familiar pattern

Retail is an attractive target because it holds payment data, loyalty program data and large volumes of personal information, and because its systems are wide, seasonal and heavily dependent on vendors. In the incidents we have worked on and followed in the public record, the entry point is rarely exotic. It is more often a credential harvested from a vendor, a remote access tool left exposed, or a flaw in a system that was due to be patched.

Ransomware and extortion have added a second layer. Attackers may exfiltrate data before encrypting systems, which means a company can restore operations and still face a notification obligation and a negotiation over stolen files. The legal analysis has to run alongside the technical recovery from the first hour.

The first 72 hours

Three decisions made early shape much of what follows. The first is who directs the investigation. Engaging outside counsel to retain the forensic firm, and structuring the work so that it is directed for the purpose of giving legal advice, is the best available protection for privilege, although courts have been willing to look closely at whether a report was really prepared for litigation or for business purposes. Keeping a separate, non-privileged track for remediation and for any report that will be shared with auditors or insurers is a sensible way to reduce that risk.

The second is what the company says and to whom. Statements to employees, customers, franchisees and the press should be accurate when made and updated as facts change. Early reassurance that later proves wrong is a common source of regulatory and securities exposure.

The third is regulator contact. Law enforcement can be a valuable partner, and early engagement is often encouraged by agencies. Contact with data protection authorities and sector regulators should be planned, consistent and reflect what is actually known.

Notification is a patchwork

Every US state has a breach notification statute, with different definitions of personal information, different triggers and different deadlines, and several require notice to the state attorney general. Companies that sell online need to map customers to states quickly, and should assume that the strictest applicable deadline will set the pace.

Public companies must also consider the SEC rules that require disclosure of a material cybersecurity incident on Form 8-K within four business days of determining that it is material. The determination is not a formality. The SEC has said companies should make it without unreasonable delay, and it expects the analysis to look at qualitative as well as quantitative factors such as reputational harm and customer relationships.

For businesses with European customers or employees, the GDPR generally requires notice to the supervisory authority within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals, and notice to individuals where the risk is high. Payment card incidents add contractual duties to acquiring banks and card networks, and often a forensic investigation that follows the network’s own process.

Regulators and litigants look back

After an incident, the question is rarely only what happened. It is what the company had done to prevent it. The Federal Trade Commission has treated inadequate security as an unfair or deceptive practice, and state attorneys general have brought actions that focus on gaps such as missing multi-factor authentication, poor segmentation and slow patching. Class actions typically follow within days of a public announcement, with claims framed around negligence, state consumer laws and, where biometric data is involved, special statutes.

The practical answer is evidence. Board minutes that show cybersecurity was discussed, risk assessments with documented follow-up, vendor due diligence files and records of testing all help a company show that its program was reasonable, even though it did not prevent every incident.

Governance lessons

Boards should expect to be asked three questions after an incident: did we have a plan, did we follow it, and did we tell the truth about it. A written incident response plan with named decision-makers, a tested escalation path to the board, and a rehearsal at least once a year answers the first two. Disclosure controls that route security events to the legal team in time to assess materiality answer the third.

Cyber insurance deserves the same scrutiny. Notice conditions, panel vendor requirements and exclusions for certain events vary, and the time to read them is before an incident. Retailers should also confirm that backups are isolated, that critical store and fulfillment systems can run in a degraded mode, and that there is a way to communicate if email is down.

What to do now

Run a tabletop exercise that includes a vendor compromise and an extortion demand. Review notification obligations by jurisdiction and keep the map current. Test your vendor contracts against the incident you most fear. Confirm who can make the materiality decision and what information they will need. Finally, decide in advance when and how the company will speak publicly.

Tomás Ellery-Vance in Washington, D.C. and Julian Okonkwo-Hart advise retailers on incident response, regulatory engagement and the investigations and litigation that follow. Our Privacy & Cyber practice and Retail & Consumer Products industry group work together on these matters.