Working With Law Enforcement After a Cyber Incident

Reporting to the FBI Is Voluntary, Not Mandatory

The FBI’s Internet Crime Complaint Center (IC3) presents filing a complaint as strongly encouraged, not legally required. The IC3 page’s own language is recommendatory, asking victims to file a detailed complaint, which “may be referred” to law enforcement for investigation. There is no general federal law forcing a private business to report a cyber incident to the FBI.

Separate Rules Can Still Apply

Voluntary FBI reporting is distinct from mandatory reporting obligations that may come from other directions, like state data breach notification laws requiring disclosure to affected individuals and sometimes a state attorney general, or sector-specific rules such as the SEC’s cyber incident disclosure requirements for public companies. Those are separate obligations layered on top of, not replaced by, any decision about FBI reporting.

Why Businesses Report to IC3 Anyway

Even though it is not required, filing with IC3 contributes to law enforcement’s broader picture of attack patterns and can occasionally lead to assistance, particularly in larger or more unusual incidents. Your breach coach can advise on whether reporting to IC3 makes sense for your specific situation.

How This Fits Your Insurance Claim

Reporting to law enforcement is not a prerequisite for your cyber insurance claim in most cases. Your coverage runs through your policy’s own reporting requirements (first notice of loss to your insurer), which is a separate track from any decision about law enforcement involvement. See How to File a Cyber Insurance Claim for that process.