Deeper Dive: Regulatory Investigations Following A Reported Breach

We recently released our 2016 Data Security Incident Response Report ("Report"), which provides lessons learned and metrics related to over 300 data security incidents handled by our team. As noted in the report, once an incident is made public the potential ramifications include a wide-ranging investigation by a regulatory agency, such as state attorneys general. However, we found that regulatory investigations were slightly lower for incidents we managed in 2015 – 24% – down from 31% the year before.

While these statistics show that an investigation is not necessarily inevitable following every reported data incident, the frequency is such that the response to any data incident should be handled with an eye towards a potential investigation by a government agency. This means thinking long-term, instead of just getting through the immediate incident response.