Data breaches have become an unfortunately common occurrence for many companies that house significant amounts of personal data from those they serve. A proposed bill in Connecticut, referred to as Senate Bill 117, would impose additional guidelines and requirements on how companies must respond to data breach issues moving forward.
The team at Wofsey Rosen, on request, is available to advise clients on compliance strategies.
The Basics of Connecticut Senate Bill 117
The primary focuses of SB117 are:
- To set the expectation that entities should provide certain materials to the attorney general following a security breach of electronic information
- To define what qualifies as ‘personal information’
- To define what the Attorney General considers a ‘massive breach of security’
- To require a third-party forensic examination, analysis, and write-up following any massive breach
- To increase the obligations to notify those affected
- To impose penalties for failure to comply
As of March of 2026, the bill was highly favored in the Connecticut Senate, and in April, it was moved for immediate consideration.
Senate Bill 117 Defines a Massive Breach That Would Trigger New Response Changes
While the bill addresses data breaches in general, the focus is on what it defines as “massive breaches”-those that affect the personal information of 100,000 residents. Further, the exposure must result from unauthorized access to and use of a computer or network. When this type of breach has been identified, business owners would be required to report the issue and take additional steps to investigate the situation.
Why SB 117 May Require an Independent Investigation of a Massive Breach
Companies that have experienced a data breach are often incentivized to limit public exposure for fear of bad press, fines, or other fallout. Additionally, IT teams may feel pressure to minimize their reporting of the breach to protect themselves.
These are among the most important reasons that SB 117 will require entities to retain an approved third-party forensic investigator to determine what happened. While this may pose an additional financial burden on the company, the requirement is likely intended to ensure objectivity and transparency in investigations that may affect so many people.
What the Forensic Report Would Need to Cover After a Major Breach
When the forensic investigator completes their review, the Connecticut Attorney General expects to receive a detailed report of the situation, including:
- How the breach occurred
- The affected systems and data
- A timeline of what happened
- Whether appropriate safeguards were in place
- Any steps the entity took to mitigate the issue
While much of this evaluation may be considered standard practice for some companies, for others it will add new requirements and new burdens.
Concerns About The Bill and Privilege Risk
Some of those in opposition to the bill have expressed concerns about whether this information may be discoverable in litigation, raising questions about privileged information in professional settings. This is heavily targeted toward protected or privileged relationships such as those between attorneys and their clients.
Other consumer-focused concerns include the fact that a third-party investigation will expose the information, yet again. Any data replication puts those individuals at an increased risk of future breaches.
Still others raise concerns about the complexity of a thorough forensic evaluation, citing the need to work alongside law enforcement and other entities, which may make it unrealistic to meet the stricter deadlines imposed by the bill.
Last are concerns about the overall cost as an unfair burden to companies that may already be facing significant financial setbacks from the breach itself.
How the Proposal Could Affect Incident Response Timelines and Internal Investigation Processes
In the proposal, the third-party investigation report is required within 90 days of detecting the massive breach of security. This provides a concrete deadline that companies must meet, and the level of detail required in the report leaves little time to delay action.
While this timeline may increase the pressure on businesses, it also acts to protect consumers from unnecessary delays in identifying problems in security and increases protection from similar events in the future.
How Connecticut Companies Can Prepare for Stricter Breach-Response Requirements
The proposed changes may cause concern for companies, but there are several things you can do to prepare for the possible changes. First, make sure your cybersecurity policy is up to date and that all necessary staff have received adequate training to proactively reduce the risk of a breach.
Additionally, update your incident response plans to include the third-party investigation and other SB117 requirements. This may also include identifying and vetting third-party investigation companies or seeking professional guidance to ensure your policy complies with HIPAA, NIST, and other policies relevant to your work.
Plan for the costs associated with a massive breach. This includes the forensic investigator and may also include consumer protections, such as credit monitoring services or other necessary supports. You may also want to consider the costs of civil penalties if you fail to meet the new guidelines. One way you can address the costs is to purchase an insurance policy geared towards cybersecurity breaches.
The Penalties of Violating the New Massive Data Breach Guidelines
In addition to the increased requirements for handling data breaches, the proposed penalties for failing to meet these requirements are hefty. Proposed fines may range from $100,000-$500,000 depending on the type and size of your business. If the bill passes, these fines may be in addition to the costs of the forensic investigation and any other civil liabilities arising from the data breach.
What Businesses Should Watch for as the Bill Moves Through the Legislative Process
With the expedited progress of the bill, we can expect to see more discussion in the May session. Should it pass, it will go into effect in October of 2026, which does not give companies much time to prepare. Things you can stay aware of include:
- Amendments to the current proposed requirements in terms of scope or threshold
- Any additional clarification on reporting standards or obligations
- Changes to enforcement
You may monitor the bill’s progress yourself, or you may benefit from consulting the lawyers at Wofsey Rosen to help you ensure you have protected your company as thoroughly as possible.