In April 2026, the Everest ransomware group claimed it had stolen more than 250,000 Social Security numbers from a vendor connected to Frost Bank, one of Texas's largest financial institutions. Frost Bank acknowledged it had been notified of unauthorized access to a third party's systems.
What the bank allegedly didn’t do was report the incident to the Texas Attorney General's office, which state law requires within 30 days of a breach affecting 250 or more residents. Two class action lawsuits followed in May 2026, each alleging inadequate safeguards and delayed notification.
The breach itself may or may not have been preventable. The legal exposure from what came after it wasn't inevitable, but it became worse with every day the clock ticked without a disclosure.
That gap between the incident and the response is now one of the more significant liability risks for companies holding customer data. Getting breached is one legal problem, but failing to notify the right people, in the right way, within the required timeframe, is a second and entirely separate one.
Data Breach Risks Are Expanding
The traditional legal calculus around data breaches was fairly linear: a breach occurred, customers were harmed, litigation followed. The legal question was whether the company had done enough to prevent the incident.
That hasn't gone away, but a second layer of liability is becoming more common. Notification failures generate their own category of regulatory exposure and class action claims, separate from the question of whether the company's security was adequate.
In August 2025, employees of DTiQ Technologies filed a class action in federal court alleging the company failed to notify them until more than six months after discovering a cyberattack. The plaintiffs alleged harm not from the breach itself but from the extended period during which they were unaware their data had been compromised. A similar case against Conduent alleged notification delays of up to 10 months, with consolidated class action litigation still active as of early 2026.
In both cases, the companies' security failures and their notification failures became separate tracks of legal exposure, each requiring separate legal defense. The Frost Bank situation appears to be following the same pattern.
For growth-stage companies, the lesson isn't that security controls don't matter. The lesson is that a breach response that doesn't include a rigorous, timely notification process creates additional exposure.
What the Clock Actually Looks Like (and What Starts It)
The United States doesn't have a single federal breach notification law. What it has is a patchwork of 50 state laws with meaningfully different requirements. Twenty states have enacted numeric notification deadlines ranging from 30 to 60 days. The other 30 use language like "without unreasonable delay," which courts are interpreting with increasing strictness as expectations around notification response have risen.
The tightest cluster sits at 30 days: California, Colorado, Florida, New York, and Washington. California sharpened its standard further with SB 446, which took effect January 1, 2026. Under the new rule, covered entities must notify affected California residents within 30 calendar days of discovering a breach, or of being informed that one occurred.
If your business has customers in multiple states, you're operating under multiple overlapping requirements simultaneously. The strictest applicable law effectively sets your real deadline.
Discovery vs. Confirmation: The Distinction That Gets Companies in Trouble
Most state notification laws start the clock at discovery, not at confirmed verification of a breach. In practice, this means the window opens when a company had reason to know that unauthorized access may have occurred, not after it completes a forensic investigation and confirms exactly what data was affected.
Frost Bank's situation illustrates this. When a vendor notified the bank of unauthorized access to the vendor's systems, that notification almost certainly started the clock for the bank's state reporting obligations, regardless of whether Frost could verify the scope of the exposure at that moment. Waiting for a full investigation to conclude before notifying regulators or customers is a costly mistake in breach response.
The distinction between discovery and confirmation is worth building into your incident response process before an incident happens, not figuring out during one.
Third-Party Breaches Don't Reset Your Clock
Third-party vendor breaches now account for 30% of all data breaches, double the 15% recorded the year before. That number will likely continue to rise as companies consolidate more of their operations onto shared SaaS platforms, payroll processors, and managed service providers.
When a vendor is breached and customer data is involved, many companies treat the incident as the vendor's problem to investigate and disclose first. They wait for the vendor to complete its investigation and confirm scope before taking any action of their own.
State breach notification law generally doesn't work that way. Your notification obligations run from when you were informed that your data may have been involved, not from when the vendor's investigation concludes. The fact that the breach originated outside your network doesn't reset or pause your clock.
Building vendor risk management into your breach response plan means adding specific provisions: contractual requirements for vendors to notify you within a defined timeframe when their systems are compromised, clear internal protocols for what happens when you receive that notification, and legal counsel ready to assess your notification obligations the moment a vendor incident surfaces.
Executive Exposure During a Breach
Breach notification failures don't only create exposure for the company. Regulators and plaintiffs have made clear, over the past several years, that individual executives and directors can be named personally when cyber response falls short.
Regulators Treat Cyber as a Board-Level Issue
State attorneys general have explicit authority to pursue enforcement actions for notification failures, and they increasingly examine the conduct of individual executives as part of those investigations. The question regulators ask isn't just whether the company responded adequately, but whether leadership was meaningfully engaged in cybersecurity governance to begin with.
The SEC's 4-Day Rule and Its Downstream Effects on Private Companies
Public companies are now required to disclose material cyber incidents to the SEC within four business days of determining materiality. Private growth-stage companies aren't directly subject to this rule, but the downstream effects are real.
If a breach at a private company triggers a disclosure obligation for a public-company customer, investor, or partner, the private company's notification timeline gets scrutinized as part of that process. Enterprise due diligence on cybersecurity governance, including incident response capabilities and historical disclosure practices, is becoming standard for large enterprise sales agreements and fundraising rounds. Founders should expect these questions.
Where Insurance Enters the Picture
Cyber Insurance and Directors & Officers Insurance respond to the same incident but cover different exposures.
Cyber Insurance covers the company's costs: incident response, legal defense of class action claims against the entity, regulatory investigation costs, notification expenses, and customer credit monitoring. It responds to the event itself and to the obligations that follow from it.
Directors & Officers Insurance covers the personal exposure of executives and board members. When a derivative suit names founders or officers individually for failing to maintain adequate security programs, or when a regulatory investigation targets individuals rather than the entity, D&O coverage provides personal defense costs and, where applicable, indemnification.
These aren't redundant policies. They're parallel protections for parallel risks that can both be triggered by the same incident.
Building a Defensible Breach Response
The companies that navigate breach notification without generating secondary legal exposure share a common characteristic: they treat notification as a legal process that was planned before an incident occurred, not improvised in the middle of one.
- A state notification map. A pre-built reference showing which states' laws apply to your customer base, what each state's specific deadline is, what "discovery" means under each standard, and which regulatory bodies need to be notified in addition to customers.
- Legal counsel with breach notification experience on retainer. General corporate counsel is not the same as counsel experienced in navigating state AG notification requirements and class action defense. The two-week period following a breach isn’t the time to be finding a new attorney.
- Vendor incident response protocols. Contractual obligations requiring vendors to notify you within a specific timeframe when their systems are compromised, and internal processes that activate your own notification assessment the moment you receive a vendor alert.
- Insurance carrier notification. Most Cyber Insurance policies require prompt notice after a breach, and most carriers want to be engaged from the moment of discovery, not after you've made all your notification decisions. Notifying your carrier early also gives you access to breach response counsel and other resources your policy may include.
Breach notification timing has become a legal battleground because state requirements have tightened, federal requirements are being added, and plaintiffs' attorneys have gotten effective at building cases around disclosure delays. The legal exposure from a mishandled response can rival the exposure from the breach itself.
Cyber Insurance and Directors & Officers Insurance, structured to work together, are part of how companies manage both tracks of exposure when an incident occurs. The other part is a breach response plan that treats the notification clock as something to be managed proactively, starting well before an incident happens.
Talk to a Vouch advisor about how Cyber Insurance and Directors & Officers Insurance work together in a post-breach scenario.
Vouch Specialty Insurance Services, LLC (CA License #6004944) is a licensed insurance producer in states where it conducts business. A complete list of state licenses is available at vouch.us/legal/licenses. Insurance products are underwritten by various insurance carriers, not by Vouch. This material is for informational purposes only and does not create a binding contract or alter policy terms. Coverage availability, terms, and conditions vary by state and are subject to underwriting review and approval.
.png)
