Glossary

B

• Breach notification law

  A breach notification law requires notice to affected people, and often a regulator, after personal data is exposed. How US state and federal duties stack.

  Also: data breach notification law, security breach notification statute, breach notice law

• Business email compromise (BEC)

  Business email compromise is fraud that uses a compromised or spoofed business email account to divert payments. How it shows up in 8-Ks and SEC enforcement.

  Also: BEC, email account compromise, BEC fraud

C

• Consent order

  A consent order is a binding order a company agrees to so it can settle a regulator's charges, usually without admitting liability. How FTC and SEC orders work.

  Also: consent agreement, FTC consent order, settled order

D

• Data breach class action

  A data breach class action is a lawsuit brought for everyone whose data a breach exposed. How Rule 23, federal jurisdiction and standing shape breach dockets.

  Also: data breach lawsuit, breach class action, consumer data breach litigation

• Double extortion

  Double extortion is a ransomware tactic: attackers encrypt systems and steal data, then threaten to leak it unless paid. How it reads in 8-K filings.

  Also: double-extortion ransomware, encryption and data theft extortion

F

• Form 8-K Item 1.05

  Form 8-K Item 1.05 is where a US public company reports a cybersecurity incident it has judged material. How the item reads on EDGAR and in this record.

  Also: Item 1.05, 8-K Item 1.05, Material Cybersecurity Incidents

G

• GDPR Article 33 (breach notification to the supervisory authority)

  GDPR Article 33 requires a controller to notify its supervisory authority of a personal data breach within 72 hours where feasible. What triggers it, and fines.

  Also: Article 33 GDPR, GDPR 72-hour rule, GDPR breach notification

H

• HIPAA Breach Notification Rule

  The HIPAA Breach Notification Rule requires covered entities to notify individuals, HHS and sometimes the media after a breach of unsecured health information.

  Also: 45 CFR 164.400, HIPAA breach notification, HITECH breach notification

M

• Multidistrict litigation (MDL)

  Multidistrict litigation moves related federal cases to one judge for pretrial work under 28 U.S.C. 1407. How the panel decides and how a breach MDL forms.

  Also: MDL, 28 U.S.C. 1407, JPML transfer

R

• Ransomware

  Ransomware is malware that encrypts files and systems so attackers can demand payment. How it reads in SEC filings, HIPAA breach rules and sanctions advisories.

  Also: ransomware attack, ransomware incident, crypto-ransomware

S

• SEC enforcement action (cybersecurity)

  An SEC cybersecurity enforcement action is a civil case or administrative order over cyber disclosures or controls. How the cases are brought and how they read.

  Also: SEC cyber enforcement, SEC cybersecurity charges, SEC cease-and-desist order

• Significant incident (NIS2)

  Under NIS2, a significant incident causes or could cause severe disruption, financial loss or considerable damage. It triggers staged reports to national authorities.

  Also: NIS2 significant incident, NIS2 Article 23, NIS2 incident reporting