Key players include the SEC, which issued a 2018 report urging reassessment of cybersecurity controls without enforcement but warning of potential material weaknesses, lawsuits, and investor risks; law firms like Foley Hoag providing guidance; and victims such as public companies and financial entities facing rising BEC threats.[1] Evolving legal pressures encompass due diligence requirements, GDPR breach reporting (within 72 hours), CAN-SPAM penalties up to $53,088 per violation, and court scrutiny on "ordinary care" in contracts.[3][5]
This stems from BEC's escalation as the top cyberattack method per 2024 surveys, prompting updated strategies like MFA, employee training, dual approvals, and anomaly detection amid no dedicated CIS controls.[2][6][9] It's newsworthy now due to the fresh April 6 analysis amid 2026 attack surges (e.g., smarter phishing, data theft), regulatory demands for documentation/training, and tools like ITDR/XDR gaining traction for prevention.[3][4][15]