A complete practitioner's treatment of United States cybersecurity and data breach law for privacy counsel, general counsel, incident response teams, and litigators. Parts I through III map the four overlapping regimes and then work through the fifty-state notification statutes in detail, including the divergent definitions of personal information, the acquisition-versus-access trigger, risk-of-harm thresholds, encryption safe harbors, the owner-versus-maintainer distinction, and the deadline, regulator-threshold, and content requirements that make a single national notice template impossible. Parts IV through VII cover the sectoral overlays: the HIPAA Breach Notification and Security Rules, the GLBA Safeguards Rule and the federal banking agencies' 36-hour computer-security incident rule, amended Regulation S-P, the SEC's Item 1.05 and Item 106 disclosure framework for public companies, and CIRCIA together with the defense, energy, transportation, telecommunications, and insurance reporting regimes. Parts VIII through XIII cover the substantive standard of reasonable security under FTC Section 5 and state safeguards statutes, the statutory safe harbors, incident response governance, privilege over forensic investigations after Capital One and its progeny, ransomware and OFAC sanctions exposure, vendor and supply chain contracting, and cyber insurance. Part XIV covers the litigation that follows, including standing after TransUnion, the claim architecture, class settlement structures, derivative oversight claims, and officer exposure after SolarWinds. Part XV is a verification list to run against any live matter.