Unauthorized Access to Data: Federal Laws, Penalties, and Lawsuits

Unauthorized access to data carries penalties that range from a one-year misdemeanor sentence to 20 years in federal prison, with fines reaching $250,000 for individuals and higher for financial-gain cases. The same conduct can trigger civil lawsuits from victims and, when a company is on the receiving end of a breach, separate penalties for failing to report the incident on time. Which penalty applies depends on what was accessed, why, who was harmed, and whether the person has done it before.

What Qualifies as Unauthorized Access

Federal law treats two kinds of conduct as unauthorized. The first is accessing a computer with no permission at all: hacking in, using stolen credentials, breaking past a login screen you have no right to use. The second is exceeding authorized access, meaning you have some legitimate access to a system but reach into parts of it that are off-limits to you.¹

In 2021 the Supreme Court narrowed what “exceeding authorized access” means. In Van Buren v. United States, the Court held that the phrase covers only reaching into areas of a system you are not allowed to see. It does not cover using information you were allowed to see for an improper reason. The Court called this a “gates-up-or-down” test: if you can open the file, you don’t violate the Computer Fraud and Abuse Act by opening it for the wrong purpose.²

That matters in workplace situations. An employee who downloads a client list from a database she is authorized to use, then keeps it for personal use, is not committing a federal CFAA violation under the “exceeds authorized access” clause. The conduct can still breach an employment contract, a state computer crime law, or another federal statute, but it is outside this particular hook.²

CFAA Prison Terms and Fines

The CFAA is the main federal statute, and it defines “protected computer” so broadly that any internet-connected device qualifies.¹ Penalties track the seriousness of the intrusion and the offender’s record.

The baseline offense, intentionally accessing a protected computer without authorization and obtaining information, with no financial motive and no connection to another crime, is a Class A misdemeanor. Maximum prison time is one year. The maximum fine for an individual is $100,000.¹³

When the access was for commercial advantage, private financial gain, or in furtherance of another crime, the first offense becomes a felony punishable by up to five years. Felony fines run up to $250,000 for an individual, and when the offense produced a measurable gain or loss, the judge can set a fine of twice that amount.¹³

The ceiling climbs from there:

Up to 10 years for a first offense involving unauthorized access to national security information.
Up to 10 years for a first offense that intentionally damages a computer and causes serious consequences, such as threats to public safety, physical injury, or impairment of medical care.
Up to 20 years for a repeat CFAA conviction involving national security information or intentional damage to protected computers.

These higher tiers carry the same felony fine structure: $250,000 or twice the gain or loss, whichever is greater.¹³

Penalties Under the Stored Communications Act

The Stored Communications Act targets intrusions into services that hold private electronic communications. It is often charged alongside the CFAA, because the CFAA punishes the intrusion into the system and the SCA punishes the invasion of what was stored there.

SCA penalties come in two tiers. If the offense was for commercial advantage, malicious damage, private commercial gain, or in furtherance of another crime, a first offense carries up to five years and a second up to 10. For every other violation, the first offense carries up to one year and a subsequent offense up to five.⁴

Industry-Specific Federal Penalties

Some kinds of data carry their own criminal statutes, and those penalties can stack on top of CFAA and SCA charges arising from the same breach.

Health Information (HIPAA)

Knowingly obtaining or disclosing individually identifiable health information without authorization is a federal crime with three tiers:⁵

Basic violation: up to $50,000 and one year.
Obtained through false pretenses: up to $100,000 and five years.
Intent to sell, transfer, or use the data for commercial advantage, personal gain, or malicious harm: up to $250,000 and 10 years.

Financial Records (Gramm-Leach-Bliley Act)

Obtaining financial records from a financial institution through fraudulent means is punishable by up to five years. If the conduct is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, or is committed while violating another federal law, the maximum doubles to 10 years, with enhanced fines.⁶

Bypassing Digital Locks (DMCA)

If the unauthorized access involved circumventing passwords, encryption, or other technical access controls on a copyrighted work, the Digital Millennium Copyright Act applies. The DMCA bans both the act of circumvention and trafficking in tools designed primarily for it.⁷ A civil plaintiff can recover actual damages or elect statutory damages of $200 to $2,500 per act, and courts can treble those amounts against repeat offenders caught again within three years.⁸

State Computer Crime Penalties

Every state has its own computer intrusion statute, and these laws reach conduct that doesn’t meet federal thresholds. The CFAA generally requires interstate activity, a certain level of damage, or a federal interest like a government computer or a financial institution. Purely local intrusions, such as an ex reading a former partner’s email or an employee copying files to a thumb drive, often get charged under state law instead.

State penalties vary. Some states treat basic unauthorized access as a misdemeanor comparable to the federal baseline. Others have built graduated felony tiers tied to the value of data taken or the damage caused. State civil penalties against businesses that fail to meet data protection obligations can reach hundreds of thousands of dollars.

All 50 states, the District of Columbia, and U.S. territories also have breach notification laws. Deadlines differ: some states set specific windows, most use a “without unreasonable delay” standard. Missing the notification deadline is its own enforcement risk, separate from any liability for the breach itself.

Civil Lawsuits by Victims

A victim of unauthorized access can sue directly. The CFAA creates a private right of action, but only when the intrusion involved at least one qualifying factor:¹

At least $5,000 in losses across one or more victims in a one-year period.
Interference with medical examination, diagnosis, treatment, or care.
Physical injury.
A threat to public health or safety.
Damage to a federal computer used for justice, defense, or national security.

The $5,000 threshold is the one most often invoked. The statute defines “loss” to include investigation costs, damage assessment, restoration of data and systems, and lost revenue from service interruption. For claims resting only on that $5,000 factor, recovery is limited to economic damages. The CFAA authorizes compensatory damages and injunctive relief; it does not authorize punitive damages.¹

Suit must be filed within two years of the act or of discovering the damage, whichever is later. Injunctive relief is often the practical centerpiece: a court order barring further access, use, or distribution of stolen data stops ongoing harm faster than any damages award.

Reporting Obligations for Breached Organizations

Companies that get hit can face penalties of their own if they fail to report on time.

Publicly traded companies must file a Form 8-K with the SEC within four business days after determining a cybersecurity incident is material. The filing has to cover the nature, scope, and timing of the incident and its material impact on financial condition. The materiality call itself must be made without unreasonable delay after discovery. The one exception is a written determination from the U.S. Attorney General that disclosure would pose a substantial risk to national security or public safety, which can delay reporting for up to 120 days in extraordinary circumstances.⁹

Critical infrastructure operators face a separate regime under the Cyber Incident Reporting for Critical Infrastructure Act of 2022. As of early 2026 the rules are not yet enforceable. CISA extended the rulemaking timeline to May 2026 to refine the requirements based on comments on the April 2024 proposed rule. CISA encourages voluntary reporting in the meantime, and sectors like energy, healthcare, financial services, and transportation should watch for the effective date, because once the final rule takes hold the deadlines become mandatory.¹⁰

When Good-Faith Security Research Is Not Prosecuted

Not every probe of a computer system draws criminal exposure. The Department of Justice has a standing policy telling federal prosecutors to decline CFAA charges when the evidence shows good-faith security research: accessing a computer solely to test, investigate, or fix a security flaw, in a manner designed to avoid harm, with findings used to improve security for the affected systems and their users.¹¹

The policy has limits. Finding a vulnerability and then threatening the system owner to extract payment is excluded, no matter how the researcher labels it. The line is intent and method: testing to help secure a system is protected, testing to find leverage is not. Researchers working under a formal bug bounty or coordinated disclosure agreement have the firmest footing, because the agreement answers the authorization question up front.¹¹

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Supreme Court of the United States. Van Buren v United States
3
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
4
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
5
GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
6
Office of the Law Revision Counsel. 15 USC 6823 – Criminal Penalty
7
Office of the Law Revision Counsel. 17 USC 1201 – Circumvention of Copyright Protection Systems
8
Office of the Law Revision Counsel. 17 USC 1203 – Civil Remedies
9
U.S. Securities and Exchange Commission. Form 8-K
10
Cybersecurity & Infrastructure Security Agency. CIRCIA FAQs
11
U.S. Department of Justice. Justice Manual 9-48.000 – Computer Fraud