Data Breaches, Ransomware and Website Lawsuits: What Businesses Should Fix Before 2027

To our business clients: a single compromised email account, an unencrypted laptop or an inaccessible website can expose a business to notification costs, lawsuits and lost customers. This article outlines the digital risks we see most often and the steps to take before the new year.

KEY TAKEAWAYS

• Every business holds sensitive data. Employee records, customer payment details and login credentials all create legal obligations.
• Breach notification is required by law. Many states require notice to affected individuals after certain breaches.
• Business email compromise is a leading cause of loss. Wire-fraud schemes target small businesses as often as large ones.
• Your website carries legal risk. ADA accessibility claims and lawsuits over tracking tools continue to target businesses.
• Contracts and insurance matter. Vendor agreements and cyber coverage decide who pays when something goes wrong.

The Risks at a Glance

Risk	How it happens	What to do
Ransomware	Phishing email or unpatched system locks your data	Multi-factor authentication, patching, offline backups
Business email compromise	Fake invoice or altered wire instructions	Call-back verification for all payment changes
Data breach	Lost device, hacked account or vendor incident	Encryption, incident response plan, vendor contracts
Website accessibility claims	Site cannot be used with screen readers or keyboards	WCAG 2.1 AA audit and remediation
Tracking tool claims	Pixels or chat tools share visitor data with third parties	Inventory tools, update privacy notice and consent

Data Breaches and Notification Duties

Most states require businesses to notify affected individuals when certain personal information — such as Social Security, driver's license or financial account numbers — is compromised. If your employees or customers live in other states, those states' laws may also apply, with different deadlines and content requirements. Businesses that discover a breach without a plan often lose critical days.

Business Email Compromise and Wire Fraud

Criminals routinely impersonate vendors, executives, or closing attorneys to redirect payments. Once a wire is sent, recovery is difficult. A simple rule — every change to payment instructions must be confirmed by phone using a number already on file — prevents most losses. Review your bank's agreements and insurance as well; many policies limit coverage for voluntary transfers.

Website Accessibility and Online Tracking

Businesses that serve the public continue to face demand letters and lawsuits under the Americans with Disabilities Act claiming their websites are not accessible to people with disabilities. Online stores, booking tools and contact forms are common targets. Many businesses use the WCAG 2.1 AA standard as their benchmark.

Separately, plaintiffs have filed claims over analytics pixels, session-replay tools and chat widgets that share visitor information with third parties. Know which tools are on your site and make sure your privacy notice accurately describes them.

Using AI Tools Safely

Employees are using generative AI tools for email, marketing and analysis — often without approval. Entering customer data, trade secrets or confidential contract terms into an unapproved tool can breach confidentiality obligations. Adopt a written policy that lists approved tools and prohibits entering protected information.

Data Security Checklist

Security safeguards

• Turn on multi-factor authentication for email, banking, payroll and remote access.
• Encrypt laptops, phones and backups that hold business or personal data.
• Keep systems patched and remove accounts for former employees promptly.
• Test backups and keep at least one offline copy.
• Train employees on phishing and payment fraud at least annually.

Plans and policies

• Adopt a written incident response plan naming who to call first.
• Adopt call-back verification for all payment instruction changes.
• Adopt an AI acceptable-use policy.
• Update your website privacy notice to reflect the tools you actually use.

Contracts, insurance and website

• Review vendor contracts for data security, breach notice and indemnity terms.
• Review cyber insurance limits, exclusions and required safeguards.
• Commission a website accessibility audit and fix priority issues.

Let Oberman Law Firm Help Protect Your Business

Oberman Law Firm helps businesses prepare for and respond to data incidents, negotiate vendor and technology contracts, and update policies for a digital workplace.

We can review your contracts, policies and website risks, and give you a practical plan to reduce your exposure before 2027.

Schedule your data and online-risk review today. Contact Oberman Law Firm at (770) 886-2400, or visit our office at 327 Dahlonega Street, Suite 401, Cumming, Georgia 30040.

Oberman Law Firm provides this material for informational purposes only. The use of a lawyer is an important decision and should not be based solely upon advertisements.