.

Privacy & Data Security

As one of the country's leading civil defense litigation law firms, the attorneys in Marshall Dennehey's Privacy & Data Security Practice Group are focused on helping clients reduce cyber risk exposures and guiding them through incident response, containment, and compliance measures after a data breach occurs. Staffed to respond to time critical situations with 24/7 availability, our firm has handled thousands of data breaches and privacy claims for clients in the technology, health care, education, financial, banking, retail, energy, consumer protection, professional services and other industry sectors.

A Customized Approach

In the arena of privacy and data security, there is no one-size-fits-all response. At Marshall Dennehey, we partner with each client to develop a customized approach, with a focus on how decisions may impact a future defense to litigation or regulatory action. Whether it is a breach involving hundreds of individuals, or millions, we counsel clients in a way that is cost-effective, compliant with the law and protective of a company's brand.

Data breaches often involve multiple areas of a client's business. When a breach involves the theft or disclosure of trade secrets, or the violation of a company's social media policy, attorneys in our Employment Law and Technology, Media and Intellectual Property Litigation Practice Groups are available to provide critical and immediate counsel. This counsel includes assisting clients in appropriately and effectively communicating with employees who may be suspected of involvement with the breach incident.

SELECT INDUSTRIES WE SERVE

Health Care

Privacy and data security matters in the health care sector require significant knowledge of how health care systems work on both regulatory and administrative levels. Our attorneys play a critical role in helping health care clients avoid, prepare for, and respond to data breach events. Beginning with HIPAA/HITECH compliance, our attorneys provide counsel on interpretation of federal and state privacy/security laws and regulations, and assist clients in investigations by governmental agencies, including the state attorneys general and the Department of Health and Human Services Office for Civil Rights. We additionally help clients develop risk management procedures and policies that are not only required by law, but that also help to educate and prepare providers, insurers and business associates on ways sensitive patient health information can be safeguarded.

Education

Universities, colleges and other institutions of higher education across the country are increasingly the target of computer hackers. Marshall Dennehey has provided legal counsel to educational entities of all sizes in the aftermath of data breach events. Our services focus on incident response development and notification as well as containment and compliance measures, including appropriate usage of social media channels to communicate incident updates to internal and external audiences. Our client representation in this sector has included working with the U.S. Department of Education in investigating breach incidents.

Financial and Banking

Security breaches and computer hacking incidents at financial institutions have become alarmingly common. Our firm routinely works with banking and financial institutions in responding to data breaches. From compliance with the Gramm-Leach-Bliley Act requirements to working with forensic investigators in the critical initial stages, we are experienced in counseling clients through every stage of these sensitive, and often, high-profile, engagements. When necessary, we are also accustomed to working with governmental agencies such as local and state law enforcement as well as the Secret Service and the FBI to help respond to, or investigate, a breach event.

Retail, Energy, Utility and Service Industries

From e-commerce web retailers to insurance companies and their nationwide brokers, we have assisted companies in the investigation and response to data breaches as well as Payment Card Industry-Data Security Standards (PCI-DSS) compliance. With extensive experience in defending business entities in consumer-related litigation, we have the attorney resources to manage every aspect of a data breach event.

Professional Services

Professional services entities such as law firms and accounting firms are increasingly the targets of cyber criminals for personal information and sensitive data. We have assisted hundreds of professional services firms when they have been forced to respond to cyberattacks. Our services allow these clients to immediately identify the issues, respond in a timely manner, and ensure that all legal obligations are met. We also assist with communications that enable clients to reassure their constituencies that their data is protected.

AREAS OF EXPERIENCE

  • Data breach incident response and notification
  • Data security and retention policies
  • Defense of numerous state lawsuits involving federal and state law privacy breaches
  • Review of Vendor Agreements and Business Associate Agreements
  • HIPAA/HITECH violation responses
  • Investigations and audits by Department of Health and Human Services Office for Civil Rights
  • Counseling to respond to U.S. Department of Health and Human Services Centers for Medicare & Medicaid Services (CMS), state Medicaid agencies, state departments of health and insurance and state/professional licensing boards
  • Gramm-Leach-Bliley Act (GLBA) requirements
  • PCI-DSS compliance, requirements and other payment card data issues
  • Claims and litigation involving point of sale (POS) software and hardware

Our attorneys are available at any time to discuss potential legal matters, or the development of workshops and educational seminars for your company or organization.

Results

View all

Successfully Obtained a Motion to Dismiss in A Data Breach Class Action Case

We obtained a motion to dismiss in a data breach class action arising out of a ransomware attack against a hospital network. The attack compromised personal information of over 90,000 patients. In state court, our motion to dismiss was granted for lack of standing. The state court also granted our motion as to each cause of action for failure to state a claim on the basis that no implied contract existed with the entities for privacy protection and the negligence claims were not available under Florida law.

Thought Leadership

View all

Legal Updates for Privacy and Data Security

Vendor Cyber Attack Compromises PII of More Than 3 Million Hunting and Fishing License Holders in Texas

June 30, 2026

The Texas Parks & Wildlife Department (TPWD) announced earlier this month that one of its vendors which handles the sale of state hunting and fishing licenses was the victim of a cybersecurity attack. The threat actor appears to have exfiltrated personal driver’s license information, passport numbers, email addresses, phone numbers and addresses of over 3 million hunting and fishing license holders.  The State Parks Department advised that the attack did not compromise social security numbers, dates of birth or financial information. Texas Cyber Command, the state’s new cybersecurity authority formed to protect critical infrastructure and coordinate threat responses across state and local government, reportedly assisted in detecting and containing the attack. TPWD has already set up free credit monitoring for those impacted through Kroll.  According to press reports, no specific group has yet been identified as the perpetrator of the theft. TPWD also advised that business has not been interrupted and license sales were continuing. This incident once again demonstrates that cybersecurity is only as strong as the weakest link in the supply chain. Businesses must prioritize security across their own environments and those of their vendors and contractors as well.

Legal Updates for Privacy and Data Security

Identity Theft Resource Center Report Reveals Rising Data Breaches Despite Drop in Mega Breaches

February 19, 2026

The Identity Theft Resource Center (ITRC), a well-known, non-profit identity theft and fraud prevention organization, recently released its 2025 annual data breach report with significant findings for the data breach field. The ITRC tracked 3,322 data breaches in 2025 – an increase of more than 5% compared to 2024. The numbers set a new record for U.S. data breaches tracked by the ITRC over the past 20 years. These numbers also show a 79% jump in data breaches over the last five years.  Just as importantly, the number of victim notices that were sent out decreased. In 2024, the ITRC found that over 1.3 million notices had been sent out, while in 2025 less than 300,000 notices were distributed. The ITRC noted that the significant decrease in victim notices was likely due to the lack of “mega-breaches” in 2025 compared to 2024.  The ITRC also found that the financial services industry was the most breached industry in 2025 followed by health care, professional services, manufacturing, and education.  The ITRC’s president was quoted that they had found “more attacks that are more precise, more automated and more difficult to detect. Consumers can take all of the right steps, businesses can have the best cyber security and still fall victim to criminals.”   These findings are significant for the cyber security insurance field. While mega breaches may be decreasing, the overall number of breaches demonstrates that all businesses should be obtaining proper cyber security insurance, and insurance carriers should be aware that while less notices will go out, more claims will be made that can affect both underwriting and the claims procedures.  Legal Updates for Privacy & Data Security - February 19, 2026, has been prepared for our readers by Marshall Dennehey. It is solely intended to provide information on recent legal developments and is not intended to provide legal advice for a specific situation or to create an attorney-client relationship. We welcome the opportunity to provide such legal assistance as you require on this and other subjects. If you receive the alerts in error, please contact MeDeSatnick@MDWCG.com. ATTORNEY ADVERTISING pursuant to New York RPC 7.1. © 2026 Marshall Dennehey, P.C. All Rights Reserved.

News

View all

Firm Highlights

Thought Leadership

The Search-Incident-to-Arrest Doctrine Does Not License Strip Searches

In Beatty v. Gardner, No. 25-2860 (3d Cir. Sept. 16, 2026), Kyle Beatty sued police officers Clinton Gardner and Calvin Irvin under 42 U.S.C. § 1983 after they stopped, arrested, and searched him three times during a drug investigation in Williamsport, Pennsylvania. The officers initially smelled marijuana coming from the car in which Beatty was sitting and observed marijuana residue, giving them probable cause to arrest him. Beatty consented to the first pat-down, and the second search was conducted incident to his lawful arrest; neither search uncovered weapons or contraband. The officers then transported Beatty to the police station solely to strip-search him, but the strip search also revealed nothing. The District Court granted the officers summary judgment, concluding that the initial stop, arrest, and first two searches were reasonable and that qualified immunity protected the officers from liability for the strip search. The Third Circuit affirmed, but held that the strip search itself violated the Fourth Amendment. The court concluded that the search-incident-to-arrest doctrine does not automatically permit officers to strip-search an arrestee outside the jail or prison setting. Because strip searches are highly intrusive and the traditional justifications for searches incident to arrest (officer safety and preservation of evidence) did not justify the search of Beatty, the officers generally needed either the arrestee’s consent, exigent circumstances, or a warrant supported by probable cause to believe that a search beneath the clothing would reveal weapons, contraband, or evidence. Here, the officers had none of those justifications. Nevertheless, the court held that qualified immunity barred damages liability because, at the time of the search, the right against a warrantless strip search of an arrestee outside the institutional setting was not clearly established by Supreme Court or Third Circuit precedent. The court likewise upheld qualified immunity on Beatty’s First Amendment retaliation claim and affirmed summary judgment for the officers.

Four Marshall Dennehey Attorneys Selected 2026 “Top Lawyers” by Delaware Today Magazine

News

Four Marshall Dennehey Attorneys Selected 2026 “Top Lawyers” by Delaware Today Magazine

MD Selected a 2027 Best Law Firm in Multiple Practice Areas by Best Lawyers

News

Marshall Dennehey Named a 2027 Best Law Firm in Multiple Practice Areas by Best Lawyers®

Marshall Dennehey Welcomes Special Counsel David Farkouh and Michele P. Rannie to New York City Office

News

Marshall Dennehey Welcomes Special Counsel David Farkouh and Michele P. Rannie to New York City Office

Thought Leadership

Pennsylvania Supreme Court to Review Whether Legal Malpractice Claims May Be Recast as Breach of Contract Claims

The Pennsylvania Supreme Court recently granted allowance of appeal to consider whether a plaintiff may pursue a breach of contract claim against an attorney based on allegations that the attorney failed to provide competent legal services. The issue is significant in professional liability litigation because it concerns whether a plaintiff may avoid the statute of limitations applicable to professional negligence claims by characterizing the alleged misconduct as a breach of contract. Antoine Poteat retained attorneys Gary Asteak and Nino V. Tinari to represent him in a criminal matter. After his conviction was subsequently overturned through a Post Conviction Relief Act proceeding, Poteat filed suit against his former attorneys alleging that they breached their retainer agreements by failing to provide competent legal services. The attorneys argued that the claims sounded in professional negligence, rather than breach of contract, and were therefore time-barred. The trial court dismissed Poteat’s complaint, but the Superior Court, sitting en banc, reversed. The Superior Court held that the gist-of-the-action doctrine did not bar Poteat’s breach of contract claim because the alleged failure to provide competent legal services could constitute a breach of the parties’ agreement. The Court further held that a legal-services agreement contains an implied duty requiring an attorney to provide competent legal services, even where the agreement does not contain an express provision requiring such services. The Pennsylvania Supreme Court granted review in July 2026 and will consider whether the Superior Court’s decision conflicts with Pennsylvania precedent distinguishing contract and tort claims, including Bruno v. Erie Insurance Co. The Supreme Court will also address whether a plaintiff may maintain a breach of contract claim based on an implied duty to provide competent legal services without identifying a specific contractual provision that was breached. The Supreme Court’s decision could have significant implications for professional liability litigation in Pennsylvania, particularly where plaintiffs seek to characterize claims arising from alleged professional negligence as contractual claims.

Complete Victory Obtained in a Workers’ Compensation Matter

Result

Complete Victory Obtained in a Workers’ Compensation Matter

Defense Victory Obtained in Workers’ Compensation Case

Result

Defense Victory Obtained in Workers’ Compensation Case

business meeting photo

Result

Summary Judgment Obtained in Insurance Coverage Case

Thought Leadership

Two Tracks, No Preclusion: Ohio Supreme Court Preserves Separate Damages Claims After Chapter 2506 Appeals

The Supreme Court of Ohio has clarified that an administrative appeal under Ohio Revised Code Chapter 2506 does not bar a separate action for damages and declaratory relief that could not have been pursued in the administrative appeal. The Ohio Supreme Court considered Sheetz, Inc. v. Centerville (2026-Ohio-3531) as a result of a certified question from the Southern District of Ohio. The question was whether Sheetz, the gas station/convenience store brand, was barred from seeking damages in a separate action since damages were not sought in their administrative appeal. Ultimately, the Ohio Supreme Court ruled that res judicata does not bar a separate action for damages after ruling on an administrative appeal because R.C. Chapter 2506 is limited to judicial review and cannot grant affirmative relief. The case arose after Centerville’s city council rejected a site plan proposed by Sheetz, Inc. that had received unanimous approval from the City’s planning commission. Sheetz filed an administrative appeal pursuant to R.C. 2506 in the Montgomery County Court of Common Pleas, and two months later filed a complaint for damages and declaratory relief under 42 USC § 1983 as a takings action with the city, city council, and other objectors as improper takings and a violation of due process, as well as interference with business and contractual relationship. The city and city council removed the § 1983 action for damages to federal court. Montgomery County Court of Common Pleas reversed the city council’s denial, and allowed the Sheetz project to move forward. Upon that ruling, the federal court issued a show-cause order questioning whether the § 1983 action was barred by the doctrine of res judicata via claim preclusion (which includes all theories of recovery).  Sheetz argued that Ohio courts of common pleas do not have authority to award damages or declaratory relief as party of the R.C. Ch. 2506 appeal, therefore res judicata could not be triggered to apply to the § 1983 action. Additionally, Sheetz moved to certify the issue to the Ohio Supreme Court, citing differing results between the second and sixth districts on this same issue. Centerville approached the question, not from a claim preclusion standpoint, but from the holding in Grava v. Parkman, Twp which states that a final judgment rendered on the merits bars all subsequent action based on the same transaction or occurrence.  In yet another approach, an objector argued that claim preclusion was satisfied because Sheetz could have raised its damages claims in the administrative appeal – Sheetz disagrees. In their analysis, the Supreme Court of Ohio broke down the elements of a claim preclusion analysis: 1) a prior final, valid decision on the merits by a court of competent jurisdiction; (2) a second action involving the same parties, or their privies, as the first; (3) a second action raising claims that were or could have been litigated in the first action; and (4) a second action arising out of the transaction or occurrence that was the subject matter of the previous action. The Court held that R.C. Ch. 2506 does not permit a party to argue damages as R.C. Ch. 2506 limits the common pleas jurisdiction as if it were sitting on appeal, and therefore can only affirm, reverse, vacate, or modify the appealed order, or can remand the case to the administrative body. Further, the Court held that Grava’s conclusion that a final judgment precludes additional litigation for different relief is inapplicable under this fact pattern because it was meant only to apply to those matters in which the plaintiff brings the exact same case twice, but for new relief. The Court found Grava was inapplicable because Sheetz could have requested damages or declaratory relief in the R.C. 2506 appeal. Therefore, Grava would be nothing more than dicta if it even did apply. Going further, the Ohio Supreme Court disavowed Sixth Circuit precedent which, in reliance on Grava and other district court decisions, permitted an owner to seeking relief under 42 U.S.C. § 1983 alongside an administrative appeal. See Moore v Hiram Twp., 988 F.3d 353 (6th Cir.2021). The Ohio Supreme Court found that the Sixth Circuit had disregarded a critical decision in Community Concerned Citizens, Inc. v. Union Twp. Bd. of Zoning Appeals, 1993-Ohio-115, which clearly held that a R.C. Ch. 2506 appeal cannot be combined with a complaint seeking other claims for relief. Id. at ¶ 11. To that end, the Ohio Supreme Court has determined that the decisions Moore relied on (outside of Grava) are no longer good law, and that Moore was wrongly decided. The decision draws a clear procedural boundary: Chapter 2506 provides judicial review of an administrative decision, not a forum for independent claims seeking affirmative relief. Although Grava may place claims arising from a single transaction within the potential scope of claim preclusion, those claims are not barred unless the complete claim-preclusion test is satisfied. Because Sheetz could not have pursued damages or declaratory relief in its Chapter 2506 appeal, the separate action was not precluded. The remaining question for practitioners looking to apply or defend against this exception is when does the statute of limitations begin to run on damages and declaratory relief claims related to an administrative decision on appeal? A takings action in federal court has a 2-year statute of limitations, or as a state claim, 4 years (like the other tortious claims raised therein). Correlating this case with others, an administrative appeal will not likely toll the statute of limitations on claims based on a final decision by a municipal authority. Therefore, practitioners should look for these cases to be brought simultaneously.

Event

CLM 2026 Focus Conference

Allison joins three insurance industry leaders to discuss how cyber coverage disputes, the growing impact of social inflation on bodily injury claim valuation, and the use of artificial intelligence are reshaping the bad faith landscape. The panel will examine emerging sources of extra-contractual exposure, including evolving cyber insurance coverage issues and the challenges of accurately valuing bodily injury claims. Practical approaches to claim evaluation using AI, along with defense strategies designed to help prevent or successfully defend against bad faith litigation, will also be addressed.