Supplements "SolarWinds Confronts Sunburst" (723-357 -368) to provide context on types of cyberattacks and their costs as well as-at the time of the Sunburst cyberattack in December 2020-the fragmentary regulatory regimes through which U.S. states and regulatory agencies attempted to encourage disclosure of cyberattacks and pursue enforcement action against negligence in failing to adequately safeguard personally identifiable information (PII) payment card information (PCI) and protected health information (PHI).