.

Privacy & Data Security

As one of the country's leading civil defense litigation law firms, the attorneys in Marshall Dennehey's Privacy & Data Security Practice Group are focused on helping clients reduce cyber risk exposures and guiding them through incident response, containment, and compliance measures after a data breach occurs. Staffed to respond to time critical situations with 24/7 availability, our firm has handled thousands of data breaches and privacy claims for clients in the technology, health care, education, financial, banking, retail, energy, consumer protection, professional services and other industry sectors.

A Customized Approach

In the arena of privacy and data security, there is no one-size-fits-all response. At Marshall Dennehey, we partner with each client to develop a customized approach, with a focus on how decisions may impact a future defense to litigation or regulatory action. Whether it is a breach involving hundreds of individuals, or millions, we counsel clients in a way that is cost-effective, compliant with the law and protective of a company's brand.

Data breaches often involve multiple areas of a client's business. When a breach involves the theft or disclosure of trade secrets, or the violation of a company's social media policy, attorneys in our Employment Law and Technology, Media and Intellectual Property Litigation Practice Groups are available to provide critical and immediate counsel. This counsel includes assisting clients in appropriately and effectively communicating with employees who may be suspected of involvement with the breach incident.

SELECT INDUSTRIES WE SERVE

Health Care

Privacy and data security matters in the health care sector require significant knowledge of how health care systems work on both regulatory and administrative levels. Our attorneys play a critical role in helping health care clients avoid, prepare for, and respond to data breach events. Beginning with HIPAA/HITECH compliance, our attorneys provide counsel on interpretation of federal and state privacy/security laws and regulations, and assist clients in investigations by governmental agencies, including the state attorneys general and the Department of Health and Human Services Office for Civil Rights. We additionally help clients develop risk management procedures and policies that are not only required by law, but that also help to educate and prepare providers, insurers and business associates on ways sensitive patient health information can be safeguarded.

Education

Universities, colleges and other institutions of higher education across the country are increasingly the target of computer hackers. Marshall Dennehey has provided legal counsel to educational entities of all sizes in the aftermath of data breach events. Our services focus on incident response development and notification as well as containment and compliance measures, including appropriate usage of social media channels to communicate incident updates to internal and external audiences. Our client representation in this sector has included working with the U.S. Department of Education in investigating breach incidents.

Financial and Banking

Security breaches and computer hacking incidents at financial institutions have become alarmingly common. Our firm routinely works with banking and financial institutions in responding to data breaches. From compliance with the Gramm-Leach-Bliley Act requirements to working with forensic investigators in the critical initial stages, we are experienced in counseling clients through every stage of these sensitive, and often, high-profile, engagements. When necessary, we are also accustomed to working with governmental agencies such as local and state law enforcement as well as the Secret Service and the FBI to help respond to, or investigate, a breach event.

Retail, Energy, Utility and Service Industries

From e-commerce web retailers to insurance companies and their nationwide brokers, we have assisted companies in the investigation and response to data breaches as well as Payment Card Industry-Data Security Standards (PCI-DSS) compliance. With extensive experience in defending business entities in consumer-related litigation, we have the attorney resources to manage every aspect of a data breach event.

Professional Services

Professional services entities such as law firms and accounting firms are increasingly the targets of cyber criminals for personal information and sensitive data. We have assisted hundreds of professional services firms when they have been forced to respond to cyberattacks. Our services allow these clients to immediately identify the issues, respond in a timely manner, and ensure that all legal obligations are met. We also assist with communications that enable clients to reassure their constituencies that their data is protected.

AREAS OF EXPERIENCE

  • Data breach incident response and notification
  • Data security and retention policies
  • Defense of numerous state lawsuits involving federal and state law privacy breaches
  • Review of Vendor Agreements and Business Associate Agreements
  • HIPAA/HITECH violation responses
  • Investigations and audits by Department of Health and Human Services Office for Civil Rights
  • Counseling to respond to U.S. Department of Health and Human Services Centers for Medicare & Medicaid Services (CMS), state Medicaid agencies, state departments of health and insurance and state/professional licensing boards
  • Gramm-Leach-Bliley Act (GLBA) requirements
  • PCI-DSS compliance, requirements and other payment card data issues
  • Claims and litigation involving point of sale (POS) software and hardware

Our attorneys are available at any time to discuss potential legal matters, or the development of workshops and educational seminars for your company or organization.

Results

View all

Successfully Obtained a Motion to Dismiss in A Data Breach Class Action Case

We obtained a motion to dismiss in a data breach class action arising out of a ransomware attack against a hospital network. The attack compromised personal information of over 90,000 patients. In state court, our motion to dismiss was granted for lack of standing. The state court also granted our motion as to each cause of action for failure to state a claim on the basis that no implied contract existed with the entities for privacy protection and the negligence claims were not available under Florida law.

Thought Leadership

View all

Legal Updates for Privacy and Data Security

Vendor Cyber Attack Compromises PII of More Than 3 Million Hunting and Fishing License Holders in Texas

June 30, 2026

The Texas Parks & Wildlife Department (TPWD) announced earlier this month that one of its vendors which handles the sale of state hunting and fishing licenses was the victim of a cybersecurity attack. The threat actor appears to have exfiltrated personal driver’s license information, passport numbers, email addresses, phone numbers and addresses of over 3 million hunting and fishing license holders.  The State Parks Department advised that the attack did not compromise social security numbers, dates of birth or financial information. Texas Cyber Command, the state’s new cybersecurity authority formed to protect critical infrastructure and coordinate threat responses across state and local government, reportedly assisted in detecting and containing the attack. TPWD has already set up free credit monitoring for those impacted through Kroll.  According to press reports, no specific group has yet been identified as the perpetrator of the theft. TPWD also advised that business has not been interrupted and license sales were continuing. This incident once again demonstrates that cybersecurity is only as strong as the weakest link in the supply chain. Businesses must prioritize security across their own environments and those of their vendors and contractors as well.

Legal Updates for Privacy and Data Security

Identity Theft Resource Center Report Reveals Rising Data Breaches Despite Drop in Mega Breaches

February 19, 2026

The Identity Theft Resource Center (ITRC), a well-known, non-profit identity theft and fraud prevention organization, recently released its 2025 annual data breach report with significant findings for the data breach field. The ITRC tracked 3,322 data breaches in 2025 – an increase of more than 5% compared to 2024. The numbers set a new record for U.S. data breaches tracked by the ITRC over the past 20 years. These numbers also show a 79% jump in data breaches over the last five years.  Just as importantly, the number of victim notices that were sent out decreased. In 2024, the ITRC found that over 1.3 million notices had been sent out, while in 2025 less than 300,000 notices were distributed. The ITRC noted that the significant decrease in victim notices was likely due to the lack of “mega-breaches” in 2025 compared to 2024.  The ITRC also found that the financial services industry was the most breached industry in 2025 followed by health care, professional services, manufacturing, and education.  The ITRC’s president was quoted that they had found “more attacks that are more precise, more automated and more difficult to detect. Consumers can take all of the right steps, businesses can have the best cyber security and still fall victim to criminals.”   These findings are significant for the cyber security insurance field. While mega breaches may be decreasing, the overall number of breaches demonstrates that all businesses should be obtaining proper cyber security insurance, and insurance carriers should be aware that while less notices will go out, more claims will be made that can affect both underwriting and the claims procedures.  Legal Updates for Privacy & Data Security - February 19, 2026, has been prepared for our readers by Marshall Dennehey. It is solely intended to provide information on recent legal developments and is not intended to provide legal advice for a specific situation or to create an attorney-client relationship. We welcome the opportunity to provide such legal assistance as you require on this and other subjects. If you receive the alerts in error, please contact MeDeSatnick@MDWCG.com. ATTORNEY ADVERTISING pursuant to New York RPC 7.1. © 2026 Marshall Dennehey, P.C. All Rights Reserved.

News

View all

Firm Highlights

Marshall Dennehey Named a Standout in Litigation by BTI Consulting Group

News

Marshall Dennehey Named a Standout in Litigation by BTI Consulting Group

Bret E. Dubbert Joins Marshall Dennehey’s Orlando Office as Special Counsel in the Casualty Department

News

Bret E. Dubbert Joins Marshall Dennehey’s Orlando Office as Special Counsel in the Casualty Department

Defense Victory Obtained in Workers’ Compensation Case

Result

Defense Victory Obtained in Workers’ Compensation Case

Event

CLM 2026 Focus Conference

Allison joins three insurance industry leaders to discuss how cyber coverage disputes, the growing impact of social inflation on bodily injury claim valuation, and the use of artificial intelligence are reshaping the bad faith landscape. The panel will examine emerging sources of extra-contractual exposure, including evolving cyber insurance coverage issues and the challenges of accurately valuing bodily injury claims. Practical approaches to claim evaluation using AI, along with defense strategies designed to help prevent or successfully defend against bad faith litigation, will also be addressed. 

Thought Leadership

The Tolling Trap: Filing Alone Will Not Toll the Statute Without Good-Faith Service

The Eastern District of Pennsylvania recently reinforced a critical limitation on bad faith claims, holding that a timely filing alone will not preserve a cause of action absent a good-faith effort to serve the original process. The plaintiff had presented a claim for underinsured motorist benefits to his auto insurer. The insurer evaluated the claim and determined that the plaintiff’s accident-related damages did not exceed the bodily injury liability insurance limits of the at-fault driver and denied his claim. Among other claims, the plaintiff sought to present a claim for insurance bad faith under 42 Pa. C.S.A. § 8371, to which a two year statute of limitation applies. He first filed a praecipe for writ of summons before the expiration of the statute of limitation. However, the plaintiff did not attempt to serve the praecipe or writ until after the statute of limitations had expired. Additionally, the service failed as the plaintiff had mailed the original process to an incorrect address. Despite receipt of the Postal Service’s failure to deliver the original process, the plaintiff did not attempt to re-serve the writ. Two months later, the plaintiff filed a complaint and then successfully served that complaint. The insurer sought to dismiss the plaintiff’s bad faith claim as time-barred by the statute of limitations. The district court agreed. Though the plaintiff had filed a praecipe for a writ of summons prior to the expiration of the statute of limitations, the statute is only tolled if there is a good faith effort to serve that original process. In this case, the court determined that the plaintiff had failed to perform a “good faith effort to serve the original process”. Additionally, though the filing and service of a complaint can serve as alternative original process when the lawsuit is commenced by the filing of a praecipe for a writ of summons, the plaintiff filed his complaint after the statute of limitations had expired. The plaintiff’s bad faith claim was therefore determined to be barred by the statute of limitations and dismissed by the court, with prejudice. A key takeaway for the defense is not to assume that the statute of limitations has been successfully tolled by a plaintiff merely because a praecipe for a writ of summons or complaint has been filed prior to the expiration of the statute. A filed complaint or writ is only part of the equation. The defense should carefully review the docket and filings to confirm that the plaintiff also performed the requisite good faith effort to serve that original process. A thorough review of the docket may reveal that the plaintiff failed to make the good-faith service efforts necessary to toll the statute of limitations.

Thought Leadership

Florida Supreme Court Rules Florida Statute §627.70152 Does not Apply Retroactively

In a decision that resolves years of appellate uncertainty and confirms that insurers and insureds alike can rely on the legal framework in place when a policy is issued, the Supreme Court of Florida last week found that Florida Statute §627.70152, which involves an insured’s requirement to provide an insurer with pre-suit notice before filing a suit, cannot be applied retroactively. In Universal Property & Casualty Insurance Company v. Hughes, the Court was presented with the issue of whether the statutory pre-suit notice requirement applied retroactively and whether it would apply to a breach of contract of an insurance policy that was issued before the statute went into effect. Before the Court was an appeal from a homeowner, Ms. Hughes, who sued her insurance carrier, Universal Property & Casualty Insurance Company (Universal) for breach of contract under an insurance policy that was in effect from April 24, 2019 through April 24, 2020. During the policy period, Ms. Hughes suffered a loss and, on May 29, 2019, made a claim for water damage. The carrier investigated the loss and issued payment; Ms. Hughes disputed the payment, finding the amount insufficient for repairs. On July 1, 2021, Florida Statute §627.70152 went into effect, which required insureds to provide notice of intent to initiate litigation against the carrier prior to filing a lawsuit; if an insured filed the lawsuit without complying with §627.70152, a court must dismiss the case without prejudice. On August 4, 2021, Ms. Hughes filed her lawsuit against Universal for breach of contract. Universal moved to dismiss based on her failure to comply with §627.70152. Ms. Hughes contended the notice requirement could not be applied retroactively. The trial court disagreed and dismissed the lawsuit without prejudice, and Ms. Hughes appealed. During the appeal, the Fourth District Court of Appeal, in Cole v. Universal Property & Casualty, 363 So. 3d 1089 (Fla. 4th DCA 2023), ruled that Florida Statute §627.70152 did apply retroactively to policies issued before the effective date of §627.70152. However, the Sixth District Court agreed with Ms. Hughes and overturned the trial court’s ruling, finding the statute could not retroactively apply to policies issued prior to the statute effective date. Thereafter, the other district courts weighed in, with the Third District Court agreeing with the Fourth District Court, and the First, Second and Fifth District Courts agreeing with the Sixth District Court. In resolving the conflict amongst the district courts, the Supreme Court advised “as a general rule, ‘the statute in effect at the time an insurance contract is executed governs substantive issues arising in connection with that contract.’ Hassen v. State Farm Mut. Auto. Ins. Co., 674 So. 2d 106, 108 (Fla. 1996). The Court applied the two-step test when deciding whether a statute has retroactive application: “First, the Court must ascertain whether the Legislature intended for the statute to apply retroactively. Second, if such an intent is clearly expressed, the Court must determine whether retroactive application would violate any constitutional principles.” Menendez v. Progressive Exp. Ins. Co., 35 So. 3d 873, 877 (Fla. 2010). In analyzing the Legislature’s intent, the Court must determine whether the Legislature has manifested a clear command for retroactivity in the statutory text.  In review of the statutory text, the Court found nothing in the language of the statute to indicate that the phrase “all suits” was serving another purpose of expanding its reach to suits based on policies that both predate and postdate the enactment of the statute. Buis v. Universal Prop. & Cas. Ins. Co., 394 So. 3d 738, 741 (Fla. 2d DCA 2024). Further, the Court noted the statute has an effective date, which has long been considered to be evidence against retroactive application of a statute. The Court concluded that, on its face, no provision of §627.70152 speaks to application of the statute to insurance policies issued before the statute’s effective date and therefore, the Legislature did not clearly command retroactivity of the statute to include insurance policies issued prior to the enactment of the statute. The Court briefly reviewed Universal’s argument that the presuit notice requirement was procedural, not substantive, and therefore should be applied retroactively; however, the Court agreed with the Sixth District Court’s finding that, in its entirety, §627.70152 transformed an insured’s ability to sue an insurance company under a property insurance policy and an insurer’s obligations to respond to and pay insurance claims, thus making the requirement a substantive change. The Court thereby upheld the decision of the Sixth District and disapproved the decision of the Fourth District in Cole.

Complete Victory Obtained in a Workers’ Compensation Matter

Result

Complete Victory Obtained in a Workers’ Compensation Matter

Marshall Dennehey Shareholders Recognized as Florida Trend Legal Elite Notable Women Leaders in Law

News

Marshall Dennehey Shareholders Recognized as Florida Trend Legal Elite Notable Women Leaders in Law

business meeting photo

Result

Summary Judgment Obtained in Insurance Coverage Case

Thought Leadership

New Jersey Appellate Division Affirms Recreational Immunity for County Under Landowners' Liability Act

In a recent unpublished decision in Matthew Kuzma, etc. v. Middlesex County Parks Department, et al., the New Jersey Appellate Division affirmed summary judgment in favor of Middlesex County Parks Department, holding that the county was immune from liability under New Jersey's Landowners' Liability Act (LLA), notwithstanding its failure to plead the immunity as an affirmative defense in its answer to the Complaint. The case arose from injuries sustained by fourteen-year-old plaintiff, Matthew Kuzma, while playing basketball at Spring Lake Park in South Plainfield on August 23, 2019. The plaintiff observed a crack in the basketball court before beginning to play but did not consider it dangerous. During the game, his foot became caught in the crack, causing him to fall and suffer a significant ankle injury. The plaintiff alleged that the injury resulted in ongoing physical limitations and deprived him of the opportunity to play collegiate basketball. The plaintiff filed suit alleging that the defendants negligently maintained the basketball court. Although the county did not assert LLA immunity as an affirmative defense in its answers, it later moved for summary judgment on that basis. The plaintiff opposed the motion, arguing that the county had waived the defense by failing to plead it. The county maintained that the plaintiff had received sufficient notice of its intent to rely on the LLA through discovery and therefore suffered no unfair surprise or prejudice. The trial court agreed and granted summary judgment, concluding that the county should be permitted to invoke statutory immunity notwithstanding its failure to formally plead the defense. Relying heavily on the New Jersey Supreme Court's guidance in Arias v. Cnty. of Bergen, holding a county park was subject to the immunity of the LLA, the Appellate Division affirmed, holding that the county's failure to plead LLA immunity did not preclude reliance on the defense under the circumstances presented. The court determined that the plaintiff had received adequate notice of the immunity claim through discovery and that permitting the defense furthered the public-policy objectives embodied in the LLA. In affirming dismissal, the Appellate Division acknowledged the seriousness of the plaintiff's injury and the general societal interest in maintaining parks and recreational facilities in a safe condition. However, the court emphasized that both the legislature and the New Jersey Supreme Court have expressed a clear policy choice to limit liability for public and private landowners who make recreational property available for public use. The decision reinforces the courts' continuing adherence to the Landowners' Liability Act and the principle that recreational lands and facilities should be broadly protected from liability exposure, even in cases involving significant personal injuries.