Banks and other financial institutions need to be aware that the law places duties on them in two respects. First, the Federal government and states have passed a number of laws that place specific duties on banks with regard to data security and handling of data breaches.

Second, the common law obligates financial institutions — and everyone else — to exercise reasonable care in their affairs. As a result, banks also need to keep abreast of developments of new threats such as Clampi, and use at least reasonable (i.e., industry standard) measures to prevent and address them.