Who is liable if the data buyer is hacked?
The short answer
No public source says who is liable if a data buyer is hacked in a company-data deal. SimpleClosure's terms have the owner indemnify the buyer. All 50 states have breach-notification laws, and who must notify depends on the contract. Insurers are adding AI exclusions.
A breach at a buyer is a live question. In March 2026 a poisoned open-source release exposed Mercor, an AI data company. The story is in Mercor data breach.
What do published buyer terms say about breach liability?
Very little, and what they say favors the buyer. SimpleClosure's terms make the owner indemnify SimpleClosure, which means cover its losses. That covers three things:
- breach of warranties
- privacy-law violations
- claims tied to personal information in the owner's data
They cap SimpleClosure's own liability at the greater of the amount paid in the prior six months or $100.
Who has to notify people after a breach?
All 50 states, the District of Columbia and several territories have breach-notification laws (National Conference of State Legislatures).
Who must notify after a breach at a licensee depends on the contract. It also depends on whether the data was licensed or sold. That is a question for counsel before the deal. After an incident it is late.
California adds a duty on the seller side. A business that sells personal information has to keep reasonable security in place alongside the sale contract (California Civil Code 1798.100(d) to (e)).
Does insurance cover it?
Don't assume so.
Fenwick's review sorts the policy types:
- Cyber policies are relatively stable.
- Tech errors and omissions forms face growing scrutiny.
- Directors and officers and employment practices forms show the biggest change. Broad "absolute" AI exclusions are appearing.
ISO introduced generative-AI exclusions for general liability forms in January 2026.
Fenwick's advice is to read insuring agreements, definitions and exclusions together. Ask your buyer or insurer in writing whether a claim from an AI data license would be covered.
If someone says the deal itself is insured, what to ask for when a deal is called insured has the checklist.
What should you ask before you sign?
Ask who holds the data and where. Ask who must notify after a breach, who pays for the loss and which policy responds. Get each answer in writing.
The rights check covers your own side: contracts, personal data and who can sign. The risks page tracks what buyers publish about security.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
