A Deeper Dive: Regulatory Investigations Following A Reported Breach

In our inaugural Data Security Incident Response Report (the Report), we found that regulators inquired about a company's breach 31% of the time and multi-state state Attorneys General investigations were launched less than 5% of the time.

A post-breach investigation is not guaranteed. Certainly, in large, highly public incidents, companies can expect at least an inquiry if not a full-blown investigation. A second exception is healthcare industry. In large breaches, defined by the Health Insurance Portability and Accountability Act (HIPAA) defines those which affect more than 500 people, healthcare companies and their business associates can expect an in-depth investigation. In other cases, and outside of healthcare, if the company displays a willingness to cooperate and a desire to be transparent, and it is apparent that the incident was taken seriously and reviewed at the C-suite level, oftentimes the inquiry is short-lived. One of the ways a company can achieve