Florida Website Hacked: Must You Notify Customers?

This is not legal advice. Talk to your attorney. We build and secure websites. We are not a law firm. This post quotes the statute and explains what the words say, nothing more. Whether a hack of your site counts as a "breach" under the law depends on facts only you and your attorney can weigh.

Do I have to notify customers if my Florida business website is hacked?

It depends on what was accessed. The statute requires notice to affected individuals when their "personal information" was, or is reasonably believed to have been, accessed in a breach. Notice must be "as expeditiously as practicable and without unreasonable delay," and no later than 30 days after the determination, unless an exception applies.

That wording comes from Fla. Stat. 501.171(4)(a). A hacked site that held no personal information, as the law defines it, is a different situation from one that did. Your attorney can tell you which you have.

What counts as a "breach of security" under Florida law?

The statute defines it as "unauthorized access of data in electronic form containing personal information." Good-faith access by an employee or agent does not count, as long as the information is not used for an unrelated purpose or subject to further unauthorized use.

The definitions are in section 501.171(1). Notice the key word is access. The text does not say the data must be copied or misused for a breach to exist.

What is "personal information" in the statute?

The law lists two combinations. One is a name with data such as a Social Security number, driver license, passport number, financial account or card number with access code, medical or health insurance information, or biometric data. The other is an email address or user name with a password or security answer that opens an online account.

The statute says the term does not include information that is "encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable."

Who is a "covered entity"?

The statute defines it as "a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information." The text does not set a size minimum for this definition. In plain terms, a business of any size that holds personal information can fall under it.

Separately, subsection (2) says covered entities, governmental entities and third-party agents "shall take reasonable measures to protect and secure data in electronic form containing personal information." The statute does not define "reasonable measures" in that subsection, so ask your attorney how it applies to you.

How fast must I act?

The statute sets a 30-day outer limit for notice to individuals, counted from "the determination of a breach or reason to believe a breach occurred." A law enforcement agency can ask in writing for a delay if notice would interfere with a criminal investigation.

For breaches affecting 500 or more individuals in Florida, notice must also go to the Department of Legal Affairs within 30 days. A covered entity "may receive 15 additional days" if it gives good cause for delay in writing within the first 30 days. See section 501.171(3).

• • Individuals: as expeditiously as practicable, no later than 30 days.
• • Department of Legal Affairs: required at 500 or more individuals in this state, within 30 days.
• • Credit reporting agencies: required if notice goes to more than 1,000 individuals at one time.

Is there any case where notice to individuals is not required?

Yes. Notice to affected individuals is not required if, after an investigation and consultation with law enforcement, the covered entity "reasonably determines that the breach has not and will not likely result in identity theft or any other financial harm." It must be documented in writing, kept for at least 5 years, and given to the department within 30 days.

That is a legal judgment with a paper trail. It is a good example of a decision to make with your attorney, not alone.

What must the notice say, and how is it sent?

Notice goes by written mail to the individual's address in your records, or by email to the address in your records. At a minimum it must include the date or estimated date range of the breach, a description of the personal information accessed, and contact information for questions. Substitute notice is allowed in limited cases listed in section 501.171(4)(f).

What are the penalties?

A violation is treated as an unfair or deceptive trade practice, enforced by the Department of Legal Affairs. Breaking the notice rules can also bring a civil penalty not to exceed $500,000. The schedule is $1,000 per day for the first 30 days, then $50,000 for each 30-day period up to 180 days.

The statute adds that the penalties apply "per breach and not per individual affected," and that it "does not establish a private cause of action" (subsection 10). Read section 501.171(9) and (10) in full with your attorney.

What if a vendor or host was the one breached?

The statute covers "third-party agents," meaning entities contracted to maintain, store or process personal information for you. If a breach happens in a system a third-party agent maintains, it must notify the covered entity "no later than 10 days" after determination. The covered entity then provides the required notices.

What should I do about the website itself?

Cleaning the site and finding how the attacker got in is a separate task from the legal one, and the two should happen together. Start with My WordPress Site Was Hacked: What Do I Do in the First Hour? and our WordPress security service.

A written record of what was accessed, when and how the hole was closed is useful to your attorney. A PHP flaw such as php2shell is one way a server can be exposed, so check your version with the free PHP version checker. Ask your host to keep its logs.

Frequently asked questions

Does the law require me to have security?

Subsection (2) requires "reasonable measures to protect and secure data in electronic form containing personal information." What counts as reasonable is a question for your attorney.

Can a customer sue me under this section?

The statute says it "does not establish a private cause of action." That does not speak to other laws, so ask your attorney.

Does my business insurance cover a hacked website?

We cannot say. Read your policy and ask your agent and attorney.

Next step

If your site was hacked, book a call and we will start on the technical side while you speak with your attorney. We cannot give legal advice.

This article is general information, not legal or compliance advice. Talk to your attorney about your situation. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.