Cybersecurity Failures And Board Liability: What Directors And Executives Must Know

Introduction

In today’s digitally driven economy, cyberattacks¹ have evolved from peripheral risks into existential corporate concerns. Such incidents do far more than disrupt systems: they erode shareholder value, trigger multi-jurisdictional regulatory investigations, and increasingly expose directors to personal litigation, reputational damage, and potential disqualification from office. Digital security has accordingly become a paramount boardroom priority, with affected parties and stakeholders directing scrutiny at the board itself by demanding answers on oversight failures, risk management lapses, and due diligence deficiencies.

A critical question often is, when a cyber incident occurs in an organisation, who bears liability for such a breach? Is it the organisation? Its executives? Or the hackers who are often unknown and undetectable? While the organisation would often bear the economic loss from such an attack, it is noteworthy that its executives can also be exposed to