What You Should Know About Security Breaches: Notification Requirements, Insider Trading Implications, and Reporting Obligations

The Recent Wave of Security Breaches

Hardly a week passes without a news story about the theft of personal data from the computer database of a major company or organization. In this year alone, the personal information of at least nine million people has been compromised by database breaches at companies that keep such information.

Information security studies have indicated that the number of database breaches has increased recently, along with their frequency, severity, and the costs of responding. One recent survey found that nearly 80 to 90 percent of Fortune 500 companies and government agencies have experienced security breaches. In 2003, California, which leads the nation in privacy protection statutes, enacted a law to address this situation. The California Database Breach Notification Security Act gives individuals early warning when their personal information has fallen into the hands of an unauthorized person so that they can take steps to protect themselves against