72-hour breach notification requirements: what each late hour costs

72-hour breach notification requirements are deadlines to tell a regulator, not the public, within three days of a defined moment. For a US insurer they come from state insurance law. New York's cybersecurity regulation, 23 NYCRR 500.17, requires notice to the superintendent no later than 72 hours after determining that a cybersecurity incident occurred, and the NAIC Insurance Data Security Model Law, adopted in 28 jurisdictions by the NAIC's Summer 2026 count, gives the commissioner the same 72 hours from a determination that a cybersecurity event occurred, though several adopting states wrote three business days instead. The residents, attorneys general and credit bureaus come later, on clocks of 30 to 60 days. Missing the 72 hours is a violation of its own, and New York has fined insurers for it.

Meeting the deadline is part of data breach notification management, the work of turning an incident into every notice owed, and the 72 hours is hard less because three days is short than because its start is a legal judgement made on incomplete facts. Botminds' Data Breach Notification Management sets every commissioner clock from the facts counsel records, drafts each notice with the items the law asks for, and counts down to each deadline; named people sign. Its fictional sample incident, a ransomware attack on Wrenfield Mutual's claims-mail vendor, runs through this page.

What are the 72-hour breach notification requirements for insurers?

An insurer licensed in New York must notify the superintendent within 72 hours of determining that a cybersecurity incident occurred, and an insurer licensed in a state that adopted the NAIC model must notify that state's commissioner within 72 hours, or the state's business-day equivalent, of determining that a cybersecurity event occurred. New York's text is precise about scope: each covered entity "shall notify the superintendent electronically in the form set forth on the department's website as promptly as possible but in no event later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider."

Both rules ask for "as promptly as possible", with 72 hours as the outer limit, and both carry a duty to keep the regulator informed: New York requires the covered entity to provide information the superintendent asks for and to update with material changes, and the model law gives a continuing obligation to update and supplement the notice. The 72-hour notice is a first report, not a final one. It is owed whether or not anyone has yet worked out who the affected people are.

New York adds a shorter clock for one case. If an insurer pays a ransom, it must tell the superintendent within 24 hours of the payment and, within 30 days, explain why payment was necessary, what alternatives it considered and what diligence it did, including on sanctions rules.

Where does the 72-hour rule come from?

The 72-hour figure is best known from Europe's General Data Protection Regulation, which requires a controller to notify its supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it". The US insurance rules took the number but not the trigger. GDPR runs from awareness of a breach; New York and the NAIC model run from a determination, which is later and is a deliberate act.

New York came first in US insurance. Its regulation took effect on 1 March 2017, and an amended version took effect on 1 November 2023. The NAIC adopted its model in the fourth quarter of 2017 and noted that its drafters intended a licensee complying with New York's regulation to be in compliance with the model. Other federal clocks sit around them but are different in kind: a listed company's Form 8-K for a material incident is due generally within four business days of the materiality determination, and HIPAA gives health insurers up to 60 calendar days after discovery for individual notice.

When does the 72-hour clock start?

The clock starts at a determination, not at the first alert and not at the moment of intrusion, and for an event at a vendor it can start earlier than the insurer's own determination. Under the model law, a licensee's deadlines for a vendor's event begin the day after the vendor's notice, or when the licensee otherwise had actual knowledge, whichever is sooner. New York's rule has no such day-after provision; it counts 72 hours from determining that an incident occurred, wherever it occurred.

That difference produced two different deadlines for the same incident in the sample. Wrenfield's vendor told it at 17:30 on Monday 21 September. In South Carolina and Virginia, whose statutes carry the model's day-after rule, the clocks started at midnight that night, before anyone at Wrenfield had decided anything. Counsel recorded the determination at 15:10 on Tuesday, more than fifteen hours into those clocks. New York's 72 hours ran from 15:10.

The 72 hours, hour by hour

Drawn to scale, the first three days of the sample incident show where the hours went. The commissioner notices themselves were drafted within an hour of the determination; most of the 72 hours went on counsel's review, the filing in each state's form and the wait before the determination itself.

Two lessons sit in the figure. The first fifteen hours of the model-law clocks were spent before the determination, which no amount of drafting speed can recover; an insurer that wants margin has to shorten the time from the vendor's notice to counsel's decision. And the business-day state, Virginia, was filed last and with the least margin, because a business-day limit invites a team to treat it as slack.

Is the 72 hours calendar time or business days?

It depends on the state, and the difference grows over a weekend. The model law and New York count 72 clock hours, weekends included. Delaware, Virginia and Iowa adopted the model with three business days; Minnesota gives five business days; Washington's insurance commissioner, under its own rule, gives two business days from the insurer's determination that consumers must be notified. The full list of adopters, and how each wrote the clock, is on the states that have adopted the model law.

The arithmetic is worth doing in advance. A determination at 17:00 on a Friday runs out at 17:00 on Monday under a 72-hour rule. Under a three-business-day rule, counting Monday as the first business day after the determination, it runs to the end of Wednesday, two days later. A public holiday moves the business-day deadline again and leaves the 72-hour one where it was. An insurer licensed in both kinds of state has two deadlines for the same event, and the earlier one is the one that matters.

What does a late breach notification cost?

A late notice is priced in three ways: as a violation of the insurance regulation, as a statutory penalty under a breach law, and as a finding that colours everything else a regulator reviews. New York's regulation treats each failure as continuing. Its enforcement section says a violation includes "the material failure to comply for any 24-hour period with any section of this Part", and among the factors in setting a penalty it lists whether timely disclosures were made to affected consumers.

"the material failure to comply for any 24-hour period with any section of this Part."

23 NYCRR 500.20(b)(2), what counts as a violation

The breach laws price lateness to residents by the day. Texas makes a company that fails to take reasonable action to notify liable for up to $100 for each individual for each consecutive day, capped at $250,000 for one breach, on top of a civil penalty of $2,000 to $50,000 for each violation. At $100 a person a day the cap is reached on the first day for any breach affecting 2,500 Texans or more; the sample incident had 3,920. Florida prices by the calendar instead, and per breach rather than per person.

New York's breach law adds its own exposure for knowing or reckless failures: a civil penalty of the greater of $5,000 or up to $20 for each failed notification, capped at $250,000. None of these figures includes the cost of the investigation that a late report tends to trigger, which is where New York's largest numbers come from.

What New York's settlements say about late reporting

In the New York settlements below, the 72-hour rule was enforced alongside the security failures that caused the breach, not on its own. In August 2025 the Department settled with Healthplex, a licensed provider of dental management services, which it found had waited more than four months after learning of a phishing incident before notifying the Department; Healthplex paid a $2 million penalty. In October 2025 it settled with eight auto insurers over attacks on online quoting tools; one of its findings against Farmers Insurance Exchange was a failure to report the cybersecurity event to the Department in time, and Farmers paid $2.775 million. In 2022 it found that the Carnival companies, licensed in New York as insurance producers, had failed "to promptly report the first Cybersecurity Event"; they paid $5 million and surrendered their producer licences.

The pattern in these cases is that late reporting appears as one finding in a list that also includes missing multi-factor authentication, weak risk assessments and improper compliance certifications. A late notice invites the question of what else was late. The cases themselves are set out in New York's cybersecurity notification requirements, read from the fines.

Why the 72 hours is rarely the hardest deadline

The 72-hour notice is a first report, owed on the facts known so far, so it can be met by a team that has prepared its form and its signer. The harder deadlines are the 30-day letters to residents, because they depend on the data review, on counsel's approval of each state's wording, and on the printer. In the sample incident the commissioner notices were filed within two days; three state letter batches were still unapproved on day 23 of a 30-day limit.

The arithmetic was tight. The letters to 4,388 Florida residents, and under the sample rules to 1,742 Colorado residents, were due 30 days after the determination of 22 September, on Thursday 22 October. The print vendor needed three business days, so the letters had to be released by Monday 19 October. They were approved and released on day 23 and mailed on Tuesday 20 October, two days inside the deadline, together with 1,515 Washington letters.

Released to print: the red notices turn blue

Breach notification timelines side by side

An insurer's incident can carry six or more deadlines from four different start events. In order of length: New York's 24 hours for a ransom payment; 72 hours for New York's superintendent and for commissioners in model-law states that kept hours; two to five business days in the states that chose business days; four business days for a listed insurer's Form 8-K from its materiality decision; 30 days for residents in Florida, California, New York and Washington and for the Texas attorney general at 250 residents; 60 days for residents in Texas and Delaware and, under HIPAA, for a health insurer's members.

Each has to be written with its start event, because "72 hours" from a determination and "30 days" from discovery cannot be compared until both are dates. A useful habit is to turn every clock into a calendar date and time on the day it starts, and to put the person who signs each notice next to it.

Every deadline as a date, against what has already happened

In the solution every one of those dates is computed from the facts counsel recorded and the start rule each statute names, warns its owner at 14 and 7 days counting print time, and is closed only with a proof. How the commissioner clock and the residents' clocks run side by side is the subject of the insurer's two clocks.

Questions people ask

Does the 72-hour clock start when a breach is discovered?

Not under the US insurance rules. New York counts 72 hours from determining that a cybersecurity incident occurred, and the NAIC model from a determination that a cybersecurity event occurred; for a vendor's event, the model starts the licensee's deadlines on the day after the vendor's notice. GDPR, by contrast, counts from becoming aware of the breach.

What is NYDFS 500.17?

It is the notice section of New York's cybersecurity regulation for financial services companies. It requires notice of a cybersecurity incident to the superintendent within 72 hours, an annual certification or acknowledgment of compliance by 15 April, and notice of a ransom payment within 24 hours with an explanation within 30 days.

Do the 72 hours include weekends?

Yes, where the rule is written in hours, as in New York and the NAIC model. States that wrote business days, such as Delaware, Virginia and Iowa with three and Minnesota with five, exclude weekends and holidays.

What if you do not know all the facts within 72 hours?

Report what you know. The model law asks for "as much of the following information as possible" and gives a continuing obligation to update, including a best estimate of affected consumers that is revised in each later report; New York requires updates on material changes.

What happens if you miss the 72-hour deadline?

In New York a missed notice is itself a violation, and the regulation counts a material failure for any 24-hour period as one. In settlements the Department has listed late reporting alongside security failures: Healthplex paid $2 million after waiting more than four months, and Farmers $2.775 million in a case that included a failure to report in time.

Is there a 72-hour rule for notifying customers?

The 72 hours in New York's regulation and the NAIC model is for the regulator. Letters to residents run on longer clocks in the breach laws covered here, such as 30 days in Florida and California and 60 days in Texas.