Companies facing data breaches are increasingly being judged not only on how they respond to cyberattacks, but also on the security measures they had in place before an incident occurred. Recent federal and state court decisions, including several involving businesses in the Southeast, highlight how failing to implement accepted cybersecurity safeguards can expose companies to costly litigation.

Although courts continue to differ on certain legal questions, recent rulings offer important guidance on what constitutes reasonable cybersecurity practices. Businesses should pay particular attention to multifactor authentication (MFA), vulnerability management, vendor oversight, training, and documentation of their security programs.

This alert is the third installment in our Cybersecurity Awareness Month series and outlines steps companies can take now to reduce cybersecurity risks and strengthen their position in potential litigation. Throughout October, we have been sharing insights on emerging cybersecurity, privacy, and AI governance developments affecting businesses. You can find our first alert here and second alert here.

How courts are defining reasonable cybersecurity

For years, courts have examined whether companies took reasonable steps to protect sensitive information in determining whether data breach lawsuits can proceed. As technology has evolved, so have the rulings. Recent decisions suggest that courts are increasingly willing to scrutinize specific cybersecurity practices, particularly when companies allegedly failed to address known vulnerabilities or implement widely accepted safeguards.

Several significant decisions illustrate this trend.

In 2015, FTC v. Wyndham Worldwide Corp. became the first federal appellate decision to hold that inadequate cybersecurity can be an "unfair" practice under Section 5 of the FTC Act. The Third Circuit’s opinion also previewed the safeguards courts still examine today. The FTC alleged that Wyndham stored payment card data as readable text, allowed easily guessed passwords, failed to use firewalls, did not restrict third-party vendors' network access, and failed to respond adequately after hackers breached its systems three times. Plaintiffs now routinely cite Section 5 and FTC guidance as evidence of what reasonable security requires, although courts disagree about how much weight that evidence carries.

More recently, courts overseeing the Change Healthcare and Snowflake litigation focused on MFA. In December 2025, the Change Healthcare federal court allowed negligence claims to proceed where plaintiffs alleged that the remote-access portal attackers lacked MFA and that the company failed to encrypt data, monitor its network, segment its systems, and limit employee access to the minimum necessary. In October 2025, the court in the Snowflake litigation found that plaintiffs plausibly alleged a foreseeable risk where Snowflake offered MFA to its cloud customers but left the setting off by default and did not require customers to use it.

These decisions do not establish that every company must implement identical cybersecurity measures. However, they demonstrate how the absence of widely recognized safeguards can become significant evidence in litigation over whether a company exercised reasonable care.

Southeast courts highlight growing litigation risks

Recent decisions in Georgia and North Carolina are particularly relevant to businesses operating in the Southeast.

In Georgia, courts have increasingly recognized circumstances in which companies may owe a duty to protect personal information from foreseeable cybersecurity threats. In Bland v. Urology of Greater Atlanta, the Georgia Court of Appeals recognized a common-law duty to safeguard personal information against foreseeable cybersecurity risks.

A September 2026 federal court ruling involving LexisNexis Risk Solutions similarly allowed negligence claims to proceed over alleged failures to use reasonable measures to safeguard personal information.

North Carolina courts have reached different results. In September 2025, the federal court in Charlotte dismissed claims by former Bojangles employees arising from a 2024 ransomware attack because they had not alleged actual or imminent misuse of their data. In June 2026, the North Carolina Business Court allowed the employees' negligence and unfair trade practices claims to proceed in state court. The employees alleged that Bojangles failed to train employees, use strong passwords, encrypt data, implement MFA, back up data, limit employee access to sensitive data, and follow the NIST Cybersecurity Framework and CIS Critical Security Controls.

In an earlier case, Capiau v. Ascendum Machinery Inc., the federal court allowed an employee’s negligence, negligence per se, and unfair trade practices claims to proceed after a 2023 ransomware attack. The employee alleged that the company failed to train its workforce, did not adopt FTC-recommended measures or meet industry standards, and waited 236 days to notify affected individuals. The Business Court relied on Capiau in the Bojangles case to hold that failing to maintain reasonable data security can be an "unfair" practice under North Carolina’s Unfair and Deceptive Trade Practices Act.

Where courts continue to differ

Despite emerging trends, the legal standards governing data breach litigation remain far from uniform.

Courts continue to disagree about when companies owe a legal duty to safeguard personal information, what injuries are sufficient to support a lawsuit, and whether federal statutes or regulatory requirements can establish the applicable standard of care.

For example, plaintiffs have relied on the FTC Act, the Health Insurance Portability and Accountability Act (HIPAA), and other regulatory requirements to support negligence claims. Some courts have permitted these theories, while others have rejected them. North Carolina is a clear example. In Capiau, the federal court allowed a negligence per se claim based on Section 5 of the FTC Act to proceed. The North Carolina Business Court has gone the other way, holding in Weddle v. WakeMed Health & Hospitals (2023), and repeating in the Bojangles case, that neither the FTC Act nor HIPAA is a public safety statute that can support negligence per se. Several federal courts in Georgia have allowed FTC Act-based negligence per se claims to proceed. Even where a statute does not independently establish liability, courts may consider regulatory guidance and recognized cybersecurity frameworks when evaluating reasonable security practices. The Bojangles case illustrates the point: the employees' ordinary negligence claim survived on allegations drawn from FTC guidance, HIPAA, and the NIST and CIS frameworks.

Third-party relationships are also receiving increased scrutiny. In July 2025, the court overseeing the MOVEit multidistrict litigation held that companies that shared consumer data with vendors using the MOVEit software could owe a duty to take reasonable care by ensuring those vendors had adequate data security, and that hiring a reputable vendor did not by itself satisfy that duty. The court also declined to treat a vendor’s general assurance of NIST compliance as a defense at the pleading stage. In the Snowflake litigation, claims are proceeding against both the cloud provider and one of its customers, Ticketmaster.

Meanwhile, several states, including Ohio, Utah, Connecticut, and Iowa, give businesses an affirmative defense or other protection in data breach suits if they maintain a written cybersecurity program that reasonably conforms to a recognized framework. Tennessee took a different approach in 2024, barring class actions arising from a cybersecurity event unless it was caused by willful and wanton misconduct or gross negligence; however, that protection has limits. In April 2026, a federal court in Tennessee found gross negligence plausibly alleged where a company allegedly failed to train its security staff and attackers went undetected for nearly a week.

For businesses operating across multiple states, these differences underscore the importance of evaluating cybersecurity practices against both applicable legal requirements and recognized industry standards.

Steps businesses should take now

Businesses should consider the following steps:

• Address known cybersecurity vulnerabilities. Establish procedures for identifying, prioritizing, and correcting security weaknesses. Maintain records documenting how critical vulnerabilities were identified, assigned, and resolved. Establish a standard cadence on review.
   
• Strengthen authentication and access controls. Implement MFA for sensitive systems, remote access, and administrative accounts. Regularly review access permissions and security settings to identify potential weaknesses.
   
• Evaluate cybersecurity programs against recognized standards. Consider frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), CIS Controls, or other standards applicable to the business. Maintain documentation demonstrating how those standards are incorporated into existing security practices.
   
• Assess third-party cybersecurity risks. Evaluate the security practices of vendors and service providers that access or maintain sensitive information. Review contractual protections, incident notification requirements, and procedures for monitoring vendor compliance.
   
• Review internal policies and incident response procedures. Ensure that cybersecurity practices align with internal policies and public representations regarding data protection. Regularly test incident response plans and review applicable breach notification obligations.
   
• Document cybersecurity decisions and oversight. Maintain records of risk assessments, security improvements, remediation efforts, and management oversight. Such documentation may become important evidence in demonstrating that a company took reasonable steps to address foreseeable risks.
   
• Train. Make sure your policies, practices, and expectations are reinforced regularly among your employees.

Companies should also consider whether they collect or retain more sensitive information than necessary. Data minimization, encryption, and network segmentation can help limit the scope and consequences of a potential breach.

Preparing for an evolving standard of care

While no security program can eliminate the possibility of a cyberattack or subsequent litigation, recent decisions demonstrate the importance of implementing reasonable safeguards and documenting the steps taken to protect sensitive information.

Businesses that follow established security practices and document their cybersecurity decisions may be better positioned to defend future claims.

For a breakdown on what courts have said recently on these issues, check out the below chart:

Multifactor authentication (MFA)	Claims proceeded where a remote-access portal lacked MFA and where a cloud provider left MFA off by default.	Change Healthcare (D. Minn. 2025) Snowflake (D. Mont. 2025) Aflac (M.D. Ga. 2026) Bojangles (N.C. Bus. Ct. 2026)
Patching known vulnerabilities	Claims proceeded where Equifax received warnings about a software flaw, circulated them internally, and did not install the available patch.	Equifax (N.D. Ga. 2019) Capital One (E.D. Va. 2020)
Encryption	Keeping unencrypted personal data in an internet-accessible database helped create a "potentially dangerous situation" giving rise to a duty.	Ramirez (11th Cir. 2023) White v. UNOS (E.D. Va. 2025)
Data retention	Claims proceeded where companies allegedly kept former employees' data, or kept unencrypted records for 16 years.	Ramirez (11th Cir. 2023) Gordon v. Zeroed-In (D. Md. 2025) White v. UNOS (E.D. Va. 2025)
Training and phishing	Phishing is "extremely common” and "can be reasonably guarded against,” which supported a duty. Failure to train security staff supported gross negligence allegations under Tennessee’s safe harbor.	Purvis (N.D. Ga. 2021) Cooper (E.D. Tenn. 2026) Capiau (W.D.N.C. 2024)
Monitoring, segmentation, and access limits	Allegations of nine days of undetected access, unsegmented systems, and employee access beyond the minimum necessary pleaded a breach of duty.	Change Healthcare (D. Minn. 2025) Haney (E.D. Tenn. 2024)
Vendor access and oversight	Using a reputable vendor does not relieve a company of reasonably ensuring the vendor has adequate security.	MOVEit (D. Mass. 2025) Wyndham (3d Cir. 2015)
Prior warnings and incidents	A duty arose where a company received “repeated notifications of the inadequacy of its systems” but did not upgrade them.	Wyndham (3d Cir. 2015)
Recognized frameworks	Negligence claims proceeded where employees alleged the company failed to implement NIST CSF 2.0 and the CIS Controls.	Bojangles (N.C. Bus. Ct. 2026)

For more information, please contact us or your regular Parker Poe contact. Click here to subscribe to our latest alerts and insights.