The holidays began and ended with the bang of newsworthy cyber breaches that illustrated the complexity of hacking scenarios, which vary in their intent and fallout on targeted companies and their customers, who are viewed as the victims. 

Beginning on Black Friday in December and lasting until Dec. 15, Target experienced a data breach involving 40 million credit, debit, and RedCard records. The retailer announced the leak in a public blog post on Dec. 19. 

"The legal framework for data theft notification is governed by states, which makes handling a multistate breach very challenging," says Matt Donovan, assistant vice president and underwriting leader of technology and privacy at Hiscox. "In Target's instance, they posted a public disclosure on their website to direct customers to call their banking providers, but they didn't directly issue mailed letters to customers notifying them of exposed information, as a breached healthcare provider would do."