CASE FILE // PC-2026-04
Status: Open
Filing Number 00.00.01
PHISHINGCOST.COM
An incident cost field report.
Filing 08.00.00Field 27 APR 2026Classification PublicStatus Open

Regulatory Fines & Notification Cost

The regulatory layer is the most variable line in the modelling worksheet. Caps are knowable. Actual fines depend on the supervisory authority's read of your control posture at the moment of compromise.

Direct answer

What a phishing breach costs in fines and notification, at a glance

SUMMARY

Regulatory exposure from a phishing breach is two separate lines, not one. Statutory fines are capped but discretionary: GDPR reaches the higher of EUR 20 million or 4% of global turnover (phishing breaches typically draw 0.5% to 2%), HIPAA runs $100 to $50,000 per violation up to a $1.5 million annual cap per violation type, and NYDFS consent orders have landed at $4.5 million (EyeMed, 2022) and $1 million (First American Title, 2023). Notification is a separate operational cost regardless of any fine: customer PII averages $160 per compromised record in the IBM 2025 dataset. The SEC adds a timing constraint rather than a dollar cap, requiring an 8-K within four business days of a materiality determination.

GDPR maximum fine
4% turnover
or EUR 20M, whichever is higher (Art 83(5))
Notification cost
$160/record
customer PII, IBM 2025
SEC disclosure clock
4 days
8-K after materiality call (Dec 2023 rule)

Full framework-by-framework caps, timing, and reference settlements below.[EUR-Lex Art 83(5), HHS OCR, SEC Final Rule 2023, NYDFS, IBM Cost of a Data Breach 2025]

Exhibit A

Regulatory framework summary

LEGAL ANNEX
CodeFrameworkMaximum exposureTiming
R-01GDPR (EU)Higher of EUR 20M or 4% of annual global turnoverNotify supervisory authority within 72 hours of awareness
R-02HIPAA (US healthcare)$100 to $50,000 per violation, $1.5M annual cap per violation typeNotify HHS, affected individuals, and prominent media (>500 records) within 60 days
R-03SEC Cyber Disclosure Rule (US public companies)Enforcement plus shareholder litigation exposure8-K within 4 business days of materiality determination
R-04State breach notification laws (US)Avg $160 per record (IBM 2025, customer PII) in notification cost; AG fines on topVaries; typically without unreasonable delay (30 to 90 days)
R-05NYDFS Cybersecurity Regulation (23 NYCRR 500)Per-violation fines, plus consent-order remediation cost72-hour notification to NYDFS
R-06PCI-DSS (payment cards, contractual)Card-network fines $5,000 to $100,000 per month plus per-card forensic costForensic investigator engagement within 24 hours of card-network notice
R-07FTC Section 5 (US, unfair or deceptive practices)Consent-order remediation, follow-on civil penaltiesInvestigation-driven
R-08GLBA Safeguards Rule (US financial institutions)Civil penalties + supervisory action30-day notification rule (effective May 2024)

Frameworks listed cover the most-cited US and EU exposures. Industry-specific layers (FERPA, FISMA, CMMC, FFIEC) apply on top.[EUR-Lex, HHS OCR, SEC, state AG offices, FTC]

R-01

GDPR (EU)

GLOBAL CAP
Maximum exposure
Higher of EUR 20M or 4% of annual global turnover
Notification timing

Notify supervisory authority within 72 hours of awareness

Phishing-driven breaches generally draw fines in the 0.5% to 2% of revenue range, scaled to the deficiency in technical and organisational measures (TOMs). British Airways was fined GBP 20M (2020) for a card-skim attack with phishing-related access elements.

R-02

HIPAA (US healthcare)

Maximum exposure
$100 to $50,000 per violation, $1.5M annual cap per violation type
Notification timing

Notify HHS, affected individuals, and prominent media (>500 records) within 60 days

OCR enforcement covers Privacy and Security Rule failures. Anthem $16M (2018) is the largest HIPAA settlement to date. Pharma and provider settlements regularly land $100K to $5M.

R-03

SEC Cyber Disclosure Rule (US public companies)

4-DAY CLOCK
Maximum exposure
Enforcement plus shareholder litigation exposure
Notification timing

8-K within 4 business days of materiality determination

Final Rule effective December 2023. Forces an early-public-disclosure decision in the middle of an active incident, complicating IR communications strategy.

R-04

State breach notification laws (US)

Maximum exposure
Avg $160 per record (IBM 2025, customer PII) in notification cost; AG fines on top
Notification timing

Varies; typically without unreasonable delay (30 to 90 days)

All 50 states have laws. California, Massachusetts, and New York are the strictest. Multi-state breaches must comply with the highest-bar requirement for the entire population.

R-05

NYDFS Cybersecurity Regulation (23 NYCRR 500)

Maximum exposure
Per-violation fines, plus consent-order remediation cost
Notification timing

72-hour notification to NYDFS

Covers banking, insurance, and financial-services entities licensed by NYDFS. EyeMed $4.5M (2022) and First American Title $1M (2023) are reference-class settlements.

R-06

PCI-DSS (payment cards, contractual)

Maximum exposure
Card-network fines $5,000 to $100,000 per month plus per-card forensic cost
Notification timing

Forensic investigator engagement within 24 hours of card-network notice

Not a regulation, but contractual. The Target breach generated approximately $67M in card-network settlement (2015). Phishing-derived POS compromise is a recurring PCI failure mode.

R-07

FTC Section 5 (US, unfair or deceptive practices)

Maximum exposure
Consent-order remediation, follow-on civil penalties
Notification timing

Investigation-driven

FTC routinely opens investigations on phishing breaches that affect consumers. Consent orders mandate 20-year third-party audit programmes. The Twitter consent order is the leading reference case.

R-08

GLBA Safeguards Rule (US financial institutions)

Maximum exposure
Civil penalties + supervisory action
Notification timing

30-day notification rule (effective May 2024)

FTC's revised Safeguards Rule now requires Section 314.4 written information security programme, qualified individual designation, and breach notification within 30 days for incidents affecting 500+ consumers.

Exhibit C

Notification cost mechanics

OPS COST
Per-record notification cost
$160
Customer PII per record (IBM 2025)

Notification is itself an operational cost line, separate from any fine. It includes letter production and postage, identity-monitoring service for affected individuals (typically 12 months free service), call-centre capacity for the inevitable inbound, and translation where a multinational population is in scope. The largest cost driver is identity-monitoring; it averages $25 to $40 per individual per year.

Multi-state breaches must comply with the highest-bar state requirement for the entire affected population. There is no practical way to slice the population by jurisdiction once notification is required. Plan to apply California or Massachusetts standards across the full set.

Updated 2026-04-27