What Is Data Theft? Federal Laws, Penalties, and Victim Remedies

Data theft is the unauthorized access, copying, or transfer of digital information, and under federal law it can send a first-time offender to prison for up to 10 years, climbing to 20 years for a repeat conviction involving national security information. Fines reach $250,000 for individuals and $500,000 for organizations, and victims can sue separately for their losses. The specific exposure depends on what was taken, why, and whether the offender has a prior record.

What Counts as Data Theft Under Federal Law

Federal law does not use “data theft” as a single defined term. Instead, it criminalizes the underlying conduct: accessing a computer without permission, or exceeding the access you were given, in order to obtain information you were not entitled to see.¹ A “protected computer” under the statute includes any computer used in or affecting interstate or foreign commerce, which in practice covers any internet-connected device.

An important distinction separates data theft from physical theft. When someone steals a laptop, the owner loses the device. When someone copies files from a server, the owner still has the originals, but the confidentiality that made those files valuable is gone. Courts treat that loss of exclusive control as a real harm, which is why copying a file without authorization satisfies the elements of the offense just as fully as deleting or moving it would.

Information Thieves Target Most Often

Attackers tend to focus on categories of data that either sell quickly on black markets or provide leverage for future crimes:

Personally identifiable information (PII), including Social Security numbers, birth dates, and addresses that let a thief impersonate the victim for credit applications or tax fraud.
Protected health information (PHI), such as medical histories, diagnoses, and insurance details covered by federal privacy rules.²
Financial records, including credit card numbers and bank account and routing numbers.
Trade secrets and intellectual property, including source code, internal strategies, manufacturing processes, and customer lists.

Individual hackers often pursue PII and financial records for quick resale, while state-sponsored groups and corporate spies tend to target trade secrets for long-term advantage.

How Data Theft Happens

Malware, including spyware, ransomware, and keyloggers, is one of the most common tools attackers use to infiltrate a system and export sensitive files. Attackers also insert malicious code into a website’s database queries to trick the system into revealing records it should keep hidden. These approaches depend on finding unpatched software flaws, misconfigured servers, or weak encryption.

Social engineering relies on manipulating people rather than exploiting software. Phishing emails push recipients to enter login credentials on fake websites or open attachments that install data-harvesting tools. Spear-phishing tailors the deception to a specific person using details scraped from social media or earlier breaches.

Insider threats account for a significant share of incidents. Employees, contractors, or business partners who already have legitimate access can download files for personal gain or to help a competitor. Because insiders do not need to bypass security controls, these cases are often harder to detect.

Federal Laws That Apply

Computer Fraud and Abuse Act

The CFAA, codified at 18 U.S.C. § 1030, is the primary federal statute used to prosecute computer-related crimes. It makes it illegal to access a protected computer without authorization, or to exceed authorized access, in order to obtain information.¹ The law defines “exceeds authorized access” as using permitted access to obtain or alter information you are not entitled to touch, so an employee who has access to some files but deliberately pulls restricted ones can be charged.

Electronic Communications Privacy Act and Stored Communications Act

The ECPA protects electronic communications while they are being made, while they are in transit, and while they are stored on computers.³ One component, the Stored Communications Act at 18 U.S.C. § 2701, specifically targets anyone who intentionally accesses a facility providing electronic communication services without authorization and obtains, alters, or blocks access to stored communications.⁴

Identity Theft Statutes

Federal law criminalizes the fraudulent creation, transfer, or use of identification documents and personal information under 18 U.S.C. § 1028.⁵ The companion statute, 18 U.S.C. § 1028A, adds a mandatory two-year consecutive prison sentence whenever stolen identity information is used during a qualifying felony.⁶ A court cannot shorten that two-year term or let it run at the same time as the sentence for the underlying felony.

Economic Espionage Act

When data theft involves trade secrets, 18 U.S.C. § 1832 applies. An individual convicted of stealing trade secrets faces up to 10 years in prison. Organizations face fines of up to $5,000,000 or three times the value of the stolen trade secret, whichever is greater.⁷

Criminal Penalties

CFAA Penalty Tiers

Sentencing under the CFAA depends on the type of information stolen, the offender’s motive, and whether the person has a prior conviction:¹

Up to 1 year for a first-time offense involving basic unauthorized access to obtain information, with no aggravating factors.
Up to 5 years when the access was for commercial advantage, private financial gain, or in furtherance of another crime, or when the value of the information obtained exceeds $5,000.
Up to 10 years for a first offense involving national-security information, or for a repeat conviction of a lower-tier offense.
Up to 20 years for a repeat offense involving national-security information.

Identity Fraud Penalties

The identity fraud statute is similarly tiered:⁵

Up to 1 year for minor offenses outside the higher categories.
Up to 5 years for general production, transfer, or use of stolen identification information.
Up to 15 years for producing or transferring fraudulent government-issued identification, offenses involving five or more identification documents, or obtaining $1,000 or more in value during a one-year period.
Up to 20 years when the offense is committed to facilitate drug trafficking or crimes of violence, or after a prior conviction under the same statute.
Up to 30 years when the offense is committed to facilitate domestic or international terrorism.

Stored Communications Act Penalties

Unauthorized access to stored electronic communications carries up to 5 years in prison for a first offense committed for commercial advantage, malicious destruction, or private financial gain, and up to 10 years for a subsequent offense. In all other cases, a first offense carries up to 1 year.⁴

Fines and Restitution

When a specific statute says “a fine under this title” without naming an amount, the general federal sentencing statute fills the gap. For felonies, an individual can be fined up to $250,000, and an organization up to $500,000. For a Class A misdemeanor that does not result in death, the cap is $100,000 for individuals and $200,000 for organizations.⁸ Courts can also order restitution requiring the offender to cover the victim’s costs, including credit monitoring, forensic investigations, and legal fees.

When Victims Can Sue

The CFAA is not only a criminal statute. It gives victims a private right to sue anyone who violated the law, provided their losses during any one-year period add up to at least $5,000 in value. The statute defines those losses broadly, including the cost of investigating the breach, assessing the damage, restoring data and systems, and any revenue lost because of service interruptions.¹ The civil lawsuit must be filed within two years of the act or within two years of discovering the damage, whichever is later.

If the stolen data qualifies as a trade secret related to a product or service used in interstate commerce, the owner can bring a civil action under the Defend Trade Secrets Act at 18 U.S.C. § 1836. Remedies include injunctive relief to stop further use of the secret, damages for actual losses and unjust enrichment, and, in cases of willful misappropriation, exemplary damages of up to twice the amount of actual damages plus reasonable attorney’s fees.⁹ In extraordinary circumstances, a court can order the seizure of property to prevent a trade secret from being disseminated further.

Data breach victims also file class-action lawsuits against organizations that failed to protect their information. These negligence cases require proving that the organization owed a duty to safeguard the data, breached that duty, and caused an actual injury. One of the biggest hurdles in federal court is proving standing: showing a concrete injury rather than a speculative fear of future harm. Victims who have already experienced financial losses or identity fraud after a breach are in the strongest position; those whose data was stolen but not yet misused often struggle to show the kind of concrete injury federal courts require.

Regulatory Enforcement and Breach Notification

The Federal Trade Commission can bring enforcement actions against companies that fail to protect consumer data. Under the Protecting Americans’ Data from Foreign Adversaries Act, violations can result in civil penalties of up to $53,088 per violation.¹⁰ The FTC also pursues companies under its broader authority to combat unfair or deceptive business practices when security failures expose consumer data.

Healthcare organizations covered by HIPAA face specific notification obligations after a breach of unsecured protected health information. They must notify affected individuals in writing no later than 60 days after discovering the breach.¹¹ The notice must describe what happened, what types of information were involved, and what steps the affected person should take. If the organization lacks current contact information for 10 or more individuals, it must post a notice on its website for at least 90 days or provide notice through major print or broadcast media.

All 50 states, the District of Columbia, and U.S. territories have enacted laws requiring businesses, and in most cases government agencies, to notify individuals when a security breach compromises their personal information. Notification deadlines, the definition of “personal information,” and the specific contents required in the notice vary by jurisdiction. Some states set deadlines as short as 30 days, while others use a more general “without unreasonable delay” standard.

Deadlines for Charges and Lawsuits

The general federal statute of limitations for non-capital criminal offenses is five years after the crime was committed.¹² Certain financial institution offenses carry a longer 10-year window. For CFAA civil lawsuits, you have two years from the date of the unauthorized act or the date you discovered the damage, whichever comes later.¹ State statutes of limitations for related claims like negligence or breach of contract vary widely, so consulting an attorney promptly helps preserve your ability to file suit before the deadline passes.

What to Do if Your Data Was Stolen

Acting quickly improves your chances of limiting the damage. The FTC operates IdentityTheft.gov, where you can report the theft, generate an official FTC Identity Theft Report, and receive a personalized recovery plan that walks you through each step and pre-fills the forms and letters you need.¹³

File a report with the FBI’s Internet Crime Complaint Center (IC3), which uses victim reports for investigative and intelligence purposes. Rapid reporting can help support the recovery of lost funds.¹⁴ For an ongoing crime or threat to safety, contact your local FBI field office directly.

Federal law gives you the right to place a free security freeze on your credit file with each of the three major credit bureaus. A freeze prevents new creditors from accessing your credit report, which blocks most attempts to open accounts in your name, and you can lift or remove it at any time. Beyond the freeze, consider placing fraud alerts on your credit reports, monitoring your financial accounts closely, and keeping detailed records of every fraudulent charge or communication. Those records may be essential if you later pursue a civil lawsuit or seek restitution through a criminal case.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
2
HHS.gov. Summary of the HIPAA Privacy Rule
3
Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA)
4
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
5
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
6
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
7
Office of the Law Revision Counsel. 18 USC 1832 – Theft of Trade Secrets
8
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
9
Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
10
Federal Trade Commission. FTC Reminds Data Brokers of Their Obligations to Comply with PADFAA
11
HHS.gov. Breach Notification Rule
12
United States Department of Justice Archives. Criminal Resource Manual 650 – Length of Limitations Period
13
IdentityTheft.gov. IdentityTheft.gov – Steps
14
Federal Bureau of Investigation. The Cyber Threat