Can executives and directors be held personally liable for a data breach?

Rarely for being breached. Readily for what happens around it. The cases that have actually reached personal liability turn on concealment, false statements to investors or regulators, and oversight so absent that a court could call it bad faith, not on the fact that an attacker got in. Uber's former security chief was convicted for hiding a breach from the FTC, not for suffering it. Directors at Marriott and SolarWinds were sued after breaches and the suits were dismissed, because the boards could show they had an oversight system, however imperfect. I'm not a lawyer and this isn't legal advice. But the pattern is clear enough to act on: the exposure is in what you say and what you can show, far more than in what happened.

The criminal case everyone cites, and what it was really about

In 2022 a federal jury convicted Joseph Sullivan, Uber's former chief security officer, of obstructing an FTC investigation and of misprision of a felony, after he arranged to pay the attackers behind a 2016 breach affecting roughly 57 million users and kept it from the FTC, which was investigating Uber's security at the time (U.S. Department of Justice, 2022). The Ninth Circuit upheld the convictions in 2025 (Daily Journal, 2025). The lesson security leaders took was "CISOs can go to prison." The accurate lesson is narrower and more useful: concealing a breach from a regulator who's asking is a crime, and the person who does the concealing carries it personally. The breach itself was never the charge.

The civil case that went the other way

In 2023 the SEC sued SolarWinds and its CISO, alleging that the company's public statements about its security practices were misleading. A judge dismissed most of the case in 2024, leaving only claims about specific statements in the company's published security statement, and in November 2025 the SEC dismissed the rest with prejudice (Tannenbaum & Rudawski, 2025). People read that as a retreat from holding executives accountable. I'd read it differently: the part of the case that survived longest was about a specific, public claim of controls that allegedly weren't true. The practical rule for executives is to say less about your security and make sure what you do say is accurate. Marketing copy about "industry-leading security" is where the exposure lives.

Directors: the oversight standard

Shareholder suits against directors after breaches rely on the Delaware Caremark line: a board can be liable for failing to implement any reporting system for a key risk, or for consciously ignoring red flags. In the Marriott case, the Delaware Court of Chancery dismissed claims against the board in 2021. In the SolarWinds derivative suit, the court dismissed in 2022 because the board had assigned cyber oversight to committees that actually functioned and had received briefings, and that was enough to defeat a claim of bad faith (Bessette et al., 2022). Two things follow. First, directors who can show a working oversight structure have, so far, been protected. Second, the protection depends on the structure existing and leaving a record. A board that never discussed cyber risk, or that received warnings and did nothing, has a different problem.

Where the exposure actually sits, in order

1. Concealment. Hiding a breach from regulators, investors, or customers who are owed notice. This is the one with criminal cases behind it.
2. False statements. Public claims about security that the company can't back up, in filings, security pages, customer questionnaires, or marketing.
3. Missed disclosure clocks. Public companies must file within four business days of determining an incident is material (U.S. Securities and Exchange Commission, 2023). Other regimes have their own deadlines.
4. Absent oversight. A board with no committee responsible, no briefings, and no record.
5. Ignored red flags. Findings raised, documented, and left, especially if the same finding appears before and after an incident.

What protects you, and it's the same list as good governance

An oversight structure that's written into committee charters and actually meets. Briefings that are recorded. Risk acceptances with names and dates on them. Public statements about security reviewed by someone who knows whether they're true. A notification process that counsel has approved. And a culture in which bad news reaches the top quickly, because every case above is at bottom a story about bad news that didn't. NACD's handbook for directors makes the legal and disclosure implications one of its six principles for precisely this reason (National Association of Corporate Directors & Internet Security Alliance, 2026).

What I'd do next

Have counsel review every public statement your company makes about its security, and check that your board's oversight of cyber risk is written into a charter and reflected in minutes. Those two tasks address most of the real exposure. If you'd like an independent view of whether your governance would stand up to the questions a regulator or plaintiff would ask, request a briefing. On giving the board something it can actually decide on, see Your Board Needs a Decision.