Should a company consider writing up a waiver of liability before warning the recipients of a spam/phishing attack executed with one of its employees' credentials? What legal ramifications are there and what is the best course of action when something like this has been discovered? Should it respond any differently to government as opposed to corporate clients?

  • Why would I sign or agree to some kind of waiver of liability attached to a "we may have messed up" message? The "what is the best best course of action" is probably not for this site, legal questions are though.
    – Ron Beyer
    Nov 20, 2018 at 16:39
  • Well, by waiver I mean a post-text perhaps on the company's e-mail footers disclosing that they cannot be held responsible. And by "best course of action", I mean, are there best practices or general guidelines that perhaps the federal government provides to give companies a standard to go by. Nov 20, 2018 at 17:49
  • Even still, if the damage is already done, you adding a footer to emails explaining you are not liable doesn't necessarily make you not-liable, especially if the employee (or other employee) acted with malice or gross negligence on the company part. The problem is you can't just "waiver/disclaimer" your liability away, especially after the fact. There is no real standard about how to act, or regulation, it is a damage control issue on the company side. Immediate notification to all parties is a good start, but I don't believe it is required.
    – Ron Beyer
    Nov 20, 2018 at 18:07

1 Answer 1


If your purpose is to eliminate (or reduce) the company's liability, then it might be a good idea to take immediate actions. Actions would include notifying affected customers, reporting to authorities, disabling certain services etc.

Absence of any specific laws, the company may have a Duty of Care to its customers. An attack may or may not be the company's fault (depending the specific of the circumstances which are beyond the scope of this answer), but failure to respond appropriately would be.

Not the answer you're looking for? Browse other questions tagged .