Data Breaches

Data breaches and cybersecurity incidents create immediate legal and regulatory exposure for the businesses and individuals involved — and the regulatory framework governing how they must be reported is complex, overlapping, and unforgiving. Broker-dealers, investment advisers, banks, and other financial institutions face obligations under rules administered by the SEC, FINRA, FinCEN, and the Bank Secrecy Act, among others. Failing to meet reporting deadlines, omitting required information from suspicious activity reports (SARs), or implementing inadequate data-protection programs can result in significant fines, remedial requirements, and reputational harm. In terms of data protection, even law firms are increasingly at risk of data breaches and the serious consequences that can flow from them.

The reporting obligations alone present real risk. FinCEN requires that SARs include specific categories of information — including the who, what, when, where, and why of the incident, along with applicable email and IP addresses. Even good-faith efforts to comply can lead to regulatory scrutiny if required elements are missing or reporting timelines are not met. And the SEC has been increasingly active in bringing enforcement actions against financial institutions for cybersecurity failures, including failures of policies and personnel that allowed breaches to occur or go unreported.

Ford O’Brien Landy LLP advises and represents clients in data breach and SAR-related regulatory matters, including SEC, FINRA, and FinCEN investigations and enforcement actions, as well as state regulatory proceedings. We also help financial institutions and other businesses design and implement data-protection compliance programs — so that when an incident occurs, the response is swift, accurate, and defensible.

Contact us to learn how we can help.