Attorneys at Parker Poe Adams & Bernstein LLP write:
Companies facing data breaches are increasingly being judged not only on how they respond to cyberattacks, but also on the security measures they had in place before an incident occurred. Recent federal and state court decisions, including several involving businesses in the Southeast, highlight how failing to implement accepted cybersecurity safeguards can expose companies to costly litigation.
[…]
Recent decisions in Georgia and North Carolina are particularly relevant to businesses operating in the Southeast.
In Georgia, courts have increasingly recognized circumstances in which companies may owe a duty to protect personal information from foreseeable cybersecurity threats. In Bland v. Urology of Greater Atlanta, the Georgia Court of Appeals recognized a common-law duty to safeguard personal information against foreseeable cybersecurity risks.
A September 2026 federal court ruling involving LexisNexis Risk Solutions similarly allowed negligence claims to proceed over alleged failures to use reasonable measures to safeguard personal information.
North Carolina courts have reached different results.
Read more at JDSupra.
