.

Privacy & Data Security

As one of the country's leading civil defense litigation law firms, the attorneys in Marshall Dennehey's Privacy & Data Security Practice Group are focused on helping clients reduce cyber risk exposures and guiding them through incident response, containment, and compliance measures after a data breach occurs. Staffed to respond to time critical situations with 24/7 availability, our firm has handled thousands of data breaches and privacy claims for clients in the technology, health care, education, financial, banking, retail, energy, consumer protection, professional services and other industry sectors.

A Customized Approach

In the arena of privacy and data security, there is no one-size-fits-all response. At Marshall Dennehey, we partner with each client to develop a customized approach, with a focus on how decisions may impact a future defense to litigation or regulatory action. Whether it is a breach involving hundreds of individuals, or millions, we counsel clients in a way that is cost-effective, compliant with the law and protective of a company's brand.

Data breaches often involve multiple areas of a client's business. When a breach involves the theft or disclosure of trade secrets, or the violation of a company's social media policy, attorneys in our Employment Law and Technology, Media and Intellectual Property Litigation Practice Groups are available to provide critical and immediate counsel. This counsel includes assisting clients in appropriately and effectively communicating with employees who may be suspected of involvement with the breach incident.

SELECT INDUSTRIES WE SERVE

Health Care

Privacy and data security matters in the health care sector require significant knowledge of how health care systems work on both regulatory and administrative levels. Our attorneys play a critical role in helping health care clients avoid, prepare for, and respond to data breach events. Beginning with HIPAA/HITECH compliance, our attorneys provide counsel on interpretation of federal and state privacy/security laws and regulations, and assist clients in investigations by governmental agencies, including the state attorneys general and the Department of Health and Human Services Office for Civil Rights. We additionally help clients develop risk management procedures and policies that are not only required by law, but that also help to educate and prepare providers, insurers and business associates on ways sensitive patient health information can be safeguarded.

Education

Universities, colleges and other institutions of higher education across the country are increasingly the target of computer hackers. Marshall Dennehey has provided legal counsel to educational entities of all sizes in the aftermath of data breach events. Our services focus on incident response development and notification as well as containment and compliance measures, including appropriate usage of social media channels to communicate incident updates to internal and external audiences. Our client representation in this sector has included working with the U.S. Department of Education in investigating breach incidents.

Financial and Banking

Security breaches and computer hacking incidents at financial institutions have become alarmingly common. Our firm routinely works with banking and financial institutions in responding to data breaches. From compliance with the Gramm-Leach-Bliley Act requirements to working with forensic investigators in the critical initial stages, we are experienced in counseling clients through every stage of these sensitive, and often, high-profile, engagements. When necessary, we are also accustomed to working with governmental agencies such as local and state law enforcement as well as the Secret Service and the FBI to help respond to, or investigate, a breach event.

Retail, Energy, Utility and Service Industries

From e-commerce web retailers to insurance companies and their nationwide brokers, we have assisted companies in the investigation and response to data breaches as well as Payment Card Industry-Data Security Standards (PCI-DSS) compliance. With extensive experience in defending business entities in consumer-related litigation, we have the attorney resources to manage every aspect of a data breach event.

Professional Services

Professional services entities such as law firms and accounting firms are increasingly the targets of cyber criminals for personal information and sensitive data. We have assisted hundreds of professional services firms when they have been forced to respond to cyberattacks. Our services allow these clients to immediately identify the issues, respond in a timely manner, and ensure that all legal obligations are met. We also assist with communications that enable clients to reassure their constituencies that their data is protected.

AREAS OF EXPERIENCE

  • Data breach incident response and notification
  • Data security and retention policies
  • Defense of numerous state lawsuits involving federal and state law privacy breaches
  • Review of Vendor Agreements and Business Associate Agreements
  • HIPAA/HITECH violation responses
  • Investigations and audits by Department of Health and Human Services Office for Civil Rights
  • Counseling to respond to U.S. Department of Health and Human Services Centers for Medicare & Medicaid Services (CMS), state Medicaid agencies, state departments of health and insurance and state/professional licensing boards
  • Gramm-Leach-Bliley Act (GLBA) requirements
  • PCI-DSS compliance, requirements and other payment card data issues
  • Claims and litigation involving point of sale (POS) software and hardware

Our attorneys are available at any time to discuss potential legal matters, or the development of workshops and educational seminars for your company or organization.

Results

View all

Successfully Obtained a Motion to Dismiss in A Data Breach Class Action Case

We obtained a motion to dismiss in a data breach class action arising out of a ransomware attack against a hospital network. The attack compromised personal information of over 90,000 patients. In state court, our motion to dismiss was granted for lack of standing. The state court also granted our motion as to each cause of action for failure to state a claim on the basis that no implied contract existed with the entities for privacy protection and the negligence claims were not available under Florida law.

Thought Leadership

View all

Legal Updates for Privacy and Data Security

Vendor Cyber Attack Compromises PII of More Than 3 Million Hunting and Fishing License Holders in Texas

June 30, 2026

The Texas Parks & Wildlife Department (TPWD) announced earlier this month that one of its vendors which handles the sale of state hunting and fishing licenses was the victim of a cybersecurity attack. The threat actor appears to have exfiltrated personal driver’s license information, passport numbers, email addresses, phone numbers and addresses of over 3 million hunting and fishing license holders.  The State Parks Department advised that the attack did not compromise social security numbers, dates of birth or financial information. Texas Cyber Command, the state’s new cybersecurity authority formed to protect critical infrastructure and coordinate threat responses across state and local government, reportedly assisted in detecting and containing the attack. TPWD has already set up free credit monitoring for those impacted through Kroll.  According to press reports, no specific group has yet been identified as the perpetrator of the theft. TPWD also advised that business has not been interrupted and license sales were continuing. This incident once again demonstrates that cybersecurity is only as strong as the weakest link in the supply chain. Businesses must prioritize security across their own environments and those of their vendors and contractors as well.

Legal Updates for Privacy and Data Security

Identity Theft Resource Center Report Reveals Rising Data Breaches Despite Drop in Mega Breaches

February 19, 2026

The Identity Theft Resource Center (ITRC), a well-known, non-profit identity theft and fraud prevention organization, recently released its 2025 annual data breach report with significant findings for the data breach field. The ITRC tracked 3,322 data breaches in 2025 – an increase of more than 5% compared to 2024. The numbers set a new record for U.S. data breaches tracked by the ITRC over the past 20 years. These numbers also show a 79% jump in data breaches over the last five years.  Just as importantly, the number of victim notices that were sent out decreased. In 2024, the ITRC found that over 1.3 million notices had been sent out, while in 2025 less than 300,000 notices were distributed. The ITRC noted that the significant decrease in victim notices was likely due to the lack of “mega-breaches” in 2025 compared to 2024.  The ITRC also found that the financial services industry was the most breached industry in 2025 followed by health care, professional services, manufacturing, and education.  The ITRC’s president was quoted that they had found “more attacks that are more precise, more automated and more difficult to detect. Consumers can take all of the right steps, businesses can have the best cyber security and still fall victim to criminals.”   These findings are significant for the cyber security insurance field. While mega breaches may be decreasing, the overall number of breaches demonstrates that all businesses should be obtaining proper cyber security insurance, and insurance carriers should be aware that while less notices will go out, more claims will be made that can affect both underwriting and the claims procedures.  Legal Updates for Privacy & Data Security - February 19, 2026, has been prepared for our readers by Marshall Dennehey. It is solely intended to provide information on recent legal developments and is not intended to provide legal advice for a specific situation or to create an attorney-client relationship. We welcome the opportunity to provide such legal assistance as you require on this and other subjects. If you receive the alerts in error, please contact MeDeSatnick@MDWCG.com. ATTORNEY ADVERTISING pursuant to New York RPC 7.1. © 2026 Marshall Dennehey, P.C. All Rights Reserved.

News

View all

Firm Highlights

Thought Leadership

Appeals Court Reverses Trial Court Order Awarding Attorney’s Fees Due to Lack of Evidence to Support Fee Awarded

The Fourth District Court of Appeal reversed the trial court’s order awarding appellate fees to People’s Trust Insurance Company based upon a lack of evidence to support the attorney’s fee award in RM & Assocs. Consulting, Inc. v. People's Trust Ins. Co., 2026 Fla. App. LEXIS 4654 (Fla. 4th DCA 2026). People’s Trust was the insurer of a residential property that had sustained water damage. RM & Associates Consulting was hired by the homeowner to perform mitigation services at the property. The homeowner assigned post-loss benefits to RM and RM subsequently filed suit against People’s Trust alleging that it had not been paid the money it was owed for the mitigation services. People’s Trust defended the lawsuit on the ground that the policy required the insured to notify the insurer before authorizing repairs so People's Trust could elect to use its preferred contractor. Because the owner did not comply with that provision, People's Trust asserted its liability was limited to the amount that its preferred contractor would have charged for the work, which People's Trust contended was $2,000. People's Trust paid that amount to RM before RM filed suit. People’s Trust filed a motion for summary judgment which was granted. RM appealed the summary judgment ruling and the ruling was upheld by the Fourth District Court of Appeal. The appellate court also granted People’s Trust’s entitlement to appellate attorney’s fees, subject to the trial court’s determination of the amount of fees, based upon an offer of judgment made by People's Trust. On remand, the trial court held an evidentiary hearing to determine the amount of attorney’s fees People’s Trust was entitled to. At the hearing, People’s Trust presented testimony from it’s fee expert, supervising trial counsel and appellate counsel. People’s Trust sought recovery of $24,866.17 for work performed by appellate counsel. The request primarily consisted of work performed in preparation of the answer brief. The fee expert testified that more than ninety hours spent preparing the answer brief was reasonable given the complexity and significance of the underlying issue. The appellate court found that the fee expert’s testimony fell short of meeting the necessary standard of demonstrating that the hours expended were necessary. The appellate court found that the billing records did not serve to cure the deficient testimony, as the billing records did not contain adequate details regarding the specific tasks performed. Rather the records contained entries such as “answer brief” which the appellate court found to be insufficient. The appellate court noted that neither the fee expert or counsel addressed how the prior research and briefing in the parallel litigation informed the work in the instant matter. The appellate court noted this was significant in that a court's attorney's fees award must exclude excessive, redundant, or otherwise unnecessary hours, citing Florida Patient's Compensation Fund v. Rowe, 472 So. 2d 1145 (Fla. 1985). Based upon the record failing to support the finding of the trial court, the 4th DCA remanded the case to the trial court for a reconsideration and redetermination of reasonable appellate attorney’s fees supported by competent substantial evidence. The 4th DCA reiterated that the fee expert’s focus on the quality of the work and the importance of the work to People’s Trust did not make up for the perceived deficiencies in the position that spending over ninety hours on a single answer brief was reasonable. Whether moving for attorney’s fees or challenging the amount of fees being sought by an opposing party, practitioners should be mindful of the evidence being used to support the claims being made. Parties should pay close attention to whether the hours being sought may be impacted by prior litigation either party may have engaged in. A party must be prepared to address how prior litigation efforts did or did not impact the amount of hours being claimed in current litigation. Lastly, billing records must be sufficiently detailed so as to support any potential future fee claim.

Thought Leadership

First DCA Reverses Excessive Jury Award Unsupported by the Evidence

In December 2019, the plaintiffs filed a claim with Universal for damages caused by a water and sewage back up through the plumbing system and existing through multiple fixtures including the washing machine drain, kitchen sink, dishwasher, bathtub and toilet. Universal investigated the claim, issued payment for resulting water damage totaling $7,000.00 in actual cash value ($12,000.00 in replacement cost value). The plaintiffs sought additional benefits for work needed to access the below-slab cast iron plumbing system due to the failure of the system from rust, deterioration, corrosion and breaks in the line. Universal denied any additional benefits for access. In 2021, the plaintiffs filed suit. During litigation, Universal sent a plumber to inspect the home and the plumber concluded the pipes were clogged but could be cleaned. The plaintiffs’ plumber testified that the plumbing system needed to be replaced due to holes and openings in the pipes. The plaintiffs introduced two estimates prepared by Triad Restoration services totaling $79,680.22 in replacement cost value and $50,219.97 in actual cash value and an executed contract with another company for repairs with the amounts of repair redacted. Since the insurance policy did not provide coverage for repair or replacement of the plumbing system, the jury only had to decide whether the plumbing system needed to be replaced, and if it did, Universal would owe for the access costs; the jury verdict form required the jury to determine both the replacement cost value and actual cash value amounts. The jury asked if it had to rely on the Triad estimates for their amounts. The trial court advised the amount awarded had to be based on the evidence presented at trial and the law given by the trial court. The jury awarded $335,000.00 in replacement cost value or $305,000.00 in actual cash value. Universal motioned for a new trial arguing the amount awarded was unsupported by the evidence and then moved for remittitur. The trial court denied both motions and this appeal followed. The court found that while a jury’s verdict should only be disturbed with caution and discretion, the trial court must give the properly challenged award close scrutiny and determine whether it bears a reasonable relation to the damaged provided, is supported by the evidence, and could have been reached in a logical manner by reasonable means §768.74(3), (5)(d)-(e), Fla. Stat. The court found the trial court did consider the statutory requirements at the hearing on Universal’s remittitur motion and was concerned about a reasonable relation to the amount of damages proved and injury suffered and whether the award was supported by the evidence, but ultimately denied the motion, reasoning that the jury had been properly instructed to fairly and adequately compensate the plaintiffs. The court noted the only evidence providing the basis for the jury verdict was Triad’s estimates and those valued the plaintiffs' claimed loss at $79,680.22 in replacement cost value and $50,219.97 in actual cash value; no valuation evidence reasonably supported the jury verdict. The plaintiffs argued that the jury was entitled to consider more than the estimates, but the court conveyed the evidence provided did not give the jury a way to reach the amounts they awarded. The court was also not swayed by the plaintiffs’ argument regarding inflation and later price increases, but the court noted that no evidence via the contract, nor testimony regarding increase in labor, material, fuel or construction costs were entered into the record.  The court concluded the jury may draw reasonable inferences from the evidence, but it may not supply a damages number by speculation. The court did not find any of the plaintiffs’ remaining argument persuasive either. The court reversed the denial of Universal’s remittitur motion and motion for new trial as to damaged and remanded the case. The court ended its opinion with advising the trial court must determine whether replacement cost value or actual cash value is the property measure of damages under the policy and order remittitur in an amount consistent with that determination and the evidence.

Marshall Dennehey Named a Standout in Litigation by BTI Consulting Group

News

Marshall Dennehey Named a Standout in Litigation by BTI Consulting Group

Event

CLM 2026 Focus Conference

Allison joins three insurance industry leaders to discuss how cyber coverage disputes, the growing impact of social inflation on bodily injury claim valuation, and the use of artificial intelligence are reshaping the bad faith landscape. The panel will examine emerging sources of extra-contractual exposure, including evolving cyber insurance coverage issues and the challenges of accurately valuing bodily injury claims. Practical approaches to claim evaluation using AI, along with defense strategies designed to help prevent or successfully defend against bad faith litigation, will also be addressed. 

graphic announcing our 6 2027 Super Lawyers & Rising Stars

News

Marshall Dennehey Announces 2027 New Jersey Super Lawyers And Rising Stars

Bret E. Dubbert Joins Marshall Dennehey’s Orlando Office as Special Counsel in the Casualty Department

News

Bret E. Dubbert Joins Marshall Dennehey’s Orlando Office as Special Counsel in the Casualty Department

Result

$19 Million Medical Malpractice Verdict Overturned

In this medical malpractice case, the trial court vacated $10 million of a $19 million verdict in post-trial motions and the Superior Court of Pennsylvania vacated the remaining $9 million on appeal.

Result

Statutory Employer Immunity Upheld

In this construction accident case that resulted in a $5 million verdict, the Supreme Court of Pennsylvania upheld the Statutory Employer Doctrine, which immunizes general contractors and other contractors on construction sites when certain elements are satisfied.

Result

$1.09 Billion Products Liability Verdict Overturned

In this products liability crashworthiness case, the Superior Court of Pennsylvania reversed a Philadelphia jury verdict of $1.09 billion, the largest verdict ever overturned by a PA appellate court.  The court ordered a new trial based on deficient jury instructions, clarified important aspects of crashworthiness law, and confirmed that so-called standard jury instructions may be incompatible with Pennsylvania law. 

Thought Leadership

United State District Court for the Middle District of Florida finds Evidence of Replacement Cost Value is Admissible and Recoverable Even When Repairs Have Not Been Made

The plaintiff filed a claim for damage as a result of Hurricane Ian. It claimed damages were over $24 million, but the carrier accepted partial coverage and paid $8,307.49 for secondary components. The carrier found hurricane damage to the building, but it was below the insurance policy’s $3.6 million deductible. The plaintiff sued for breach of the insurance policy. The carrier argued in a motion for summary judgment that plaintiff could not recover replacement cost value (RCV) because the property repairs had not been effectuated. The policy provided for RCV, but only after the repairs were completed. The carrier argued that because the repairs were not completed, the plaintiff was not entitled to RCV damages. The plaintiff argued the carrier could not withhold the actual cost value (ACV) due, which was the main allegation of the lawsuit, then fault it for not making the repairs to unlock the RCV. The United States District Court for the Middle District of Florida rejected the carrier’s argument, finding that when an insurer allegedly breached the policy by withholding coverage, it could not hide behind a repair-contingent provision to block the insured from RCV damages at trial. The court found the issue to be whether the contractual language designed to preclude certain coverage until after repairs are completed barred an insured from seeking those damages at trial when repairs were not complete. The court noted the Eleventh Circuit had not resolved this issue and neither side pointed to a definitive answer from the Florida Supreme Court. The court reasoned that it must look to the Sixth District Court of Appeal (6th DCA), which is the court which would have heard this case if it was in state court. The court noted the 6th DCA recently addressed this issue in Universal Prop. & Cas. Ins. Co. v. Rodriguez, 427 So. 3d 676 (Fla. 6th DCA 2026). The Rodriguez Court found that a breach of contract action is designed to adjudicate not only whether the contract was breached, but also evaluate the damages incurred had the breach not occurred, which the Rodriguez court found to be recovery of the RCV. This court also noted basic Florida contract principles compelled the same result, as a material breach frees the nonbreaching party to suspend its own performance and can demand the full benefit of its bargain, including RCV damages. Finally, the court found the distinction between a full denial and partial denial did not compel a different result. It found the policy required the carrier to acknowledge coverage and pay ACV for all covered damages, and the failure to do that is a material breach, entitling the insured to all of the damages available under the contract, which included the RCV.