Extract from Michael Bahar, Sarah Paul, Matt Gatewood and Andrew Weiner’s article “Litigators and Privacy: The Last People You Want to See, or the First?”
In their consideration of possible worst-case cyber attack scenarios, organizations often focus on the various types of attacks and their relative severity. But, the worst-case scenario is not the breach, it’s the reputational damage, regulatory enforcement action, the business interruption, and the inevitable litigation that follows a poorly handled breach from an unprepared organization. Given this reality, it is important to adjust planning assumptions and response scenarios to focus on addressing these drivers of post-breach exposure.
