Your business was hacked. What Texas law requires next

A breach is a technical problem and a legal one at the same moment. What you do in the first days affects fines, lawsuits and customer trust.

Contain it and keep the evidence

Shut off the access, change credentials and bring in a forensic team. Do not wipe the affected systems, because investigators and insurers will need the logs.

Call your insurer and a lawyer early

Many cyber policies require prompt notice and approved vendors. Work done under a lawyer's direction may also be protected from disclosure in later lawsuits.

Who must be told in Texas

Texas law requires a business to notify affected people when sensitive personal information was taken, without unreasonable delay and no later than 60 days after the breach is confirmed. If 250 or more Texas residents are affected, the Attorney General must be told as well, within 30 days.

Other duties

Customers in other states bring those states' rules with them. Health data, payment cards and public companies each have extra reporting rules.

What the notice should say

What happened, what information was involved, what you are doing about it and what the person can do to protect themselves. Plain language works best.

Afterwards

Fix the cause, record the decisions you made and review your contracts with vendors. Regulators ask what changed.

This article is general information about the law. It is not legal advice and reading it does not make you a client of the firm. Laws change, so speak to a lawyer about your own situation.