If hit with a spamming/phishing scam, how should a company warn its customers?
<p>Should a company consider writing up a waiver of liability before warning the recipients of a spam/phishing attack executed with one of its employees' credentials? What legal ramifications are there and what is the best course of action when something like this has been discovered? Should it respond any differently to government as opposed to corporate clients?</p>

<p>If your purpose is to eliminate (or reduce) the company's liability, then it might be a good idea to take immediate actions. Actions would include notifying affected customers, reporting to authorities, disabling certain services etc.</p>

<p>Absence of any specific laws, the company may have a <a href="https://en.wikipedia.org/wiki/Duty_of_care" rel="nofollow noreferrer">Duty of Care</a> to its customers. An attack may or may not be the company's fault (depending the specific of the circumstances which are beyond the scope of this answer), but failure to respond appropriately would be.</p>

liability waivers