CFAA Civil Claims for California Businesses: Unauthorized Access to Company Systems

Last updated: November 2026

The Computer Fraud and Abuse Act gives a business a federal civil claim against anyone who accesses its computers without authorization, or exceeds authorized access, and causes at least $5,000 in loss within a one-year period. (18 U.S.C. § 1030(g), (c)(4)(A)(i)(I).) After Van Buren, the claim reaches people who enter systems or areas that are off limits to them, not insiders who misuse data they were allowed to see. Kolmogorov Law, P.C. pursues the civil claim for Orange County and Los Angeles businesses in the Central District of California.

Call (909) 235-6116 or contact us online if someone has broken into your systems or kept using them after their access ended.

What a CFAA lawsuit requires

The CFAA is a criminal statute with a civil remedy attached. Any person who suffers damage or loss by reason of a violation may maintain a civil action for compensatory damages and injunctive or other equitable relief. (18 U.S.C. § 1030(g).) We pursue that civil claim; whether a prosecutor acts is a separate matter.

The civil action is available only if the conduct involves one of five listed factors, and for most businesses the relevant one is loss to one or more persons during any one-year period aggregating at least $5,000. (18 U.S.C. § 1030(g), (c)(4)(A)(i)(I).) Damages for a claim resting on that factor alone are limited to economic damages, and the action must be brought within two years of the act or the discovery of the damage. (18 U.S.C. § 1030(g).)

The computer must be a "protected computer," which includes any computer used in or affecting interstate or foreign commerce or communication. (18 U.S.C. § 1030(e)(2)(B).) In practice, almost any business system connected to the internet qualifies.

The usual underlying violation in business cases is intentionally accessing a computer without authorization, or exceeding authorized access, and obtaining information from it. (18 U.S.C. § 1030(a)(2)(C).)

"Without authorization" and "exceeds authorized access" after Van Buren

The statute defines "exceeds authorized access" as accessing a computer with authorization and using that access to obtain or alter information the accesser is not entitled so to obtain or alter. (18 U.S.C. § 1030(e)(6).)

The Supreme Court narrowed that phrase in 2021. A person exceeds authorized access when, with authorization to use a computer, the person obtains information from particular areas, such as files, folders, or databases, that are off limits. The Court described the test as a "gates-up-or-down" inquiry: one either can or cannot access a system, and can or cannot access particular areas within it. A police officer who was permitted to run license plate searches did not violate the statute by running one for an improper purpose. (Van Buren v. United States (2021) 593 U.S. 374, 396.)

The Ninth Circuit applied the same reasoning to public websites. Data on a public webpage, open to anyone with a browser, has no gate to raise or lower, so scraping it is likely not access "without authorization" even after a cease-and-desist letter. Password-protected systems are different. (hiQ Labs, Inc. v. LinkedIn Corp. (9th Cir. 2022) 31 F.4th 1180, 1197-1198.)

What that means for the departing employee case

This is the case I am asked about most. An employee downloads the customer database the week before resigning. While employed, the employee was allowed to open that database. Under Van Buren, that download is probably not a CFAA violation, however improper the purpose. The right claims are trade secret misappropriation, breach of the confidentiality agreement, and the California computer crime statute, which is worded differently. Our page on Penal Code section 502 explains the state claim, and our trade secret attorney page covers the misappropriation claim.

The CFAA fits a different set of facts. The former employee who logs in after termination with credentials that were never revoked. The one who kept a coworker's password and used it. The competitor's employee who gets into a password-protected customer portal through a shared login. The outside contractor who was given access to one folder and worked through the directory to others. In each of those, the gate was down, and the claim is strong.

Our departing employee protocol page covers revoking access on the day of departure.

What counts toward the $5,000 loss

"Loss" means any reasonable cost to any victim, including the cost of responding to the offense, assessing the damage, and restoring the system. It also includes revenue lost, costs incurred, or other consequential damages because of an interruption of service. (18 U.S.C. § 1030(e)(11).)

Two consequences follow. The forensic investigation itself usually gets a business over the threshold. And courts in the Ninth Circuit have generally not counted the value of the information taken unless the taking impaired the system or interrupted service. A business whose data was copied while its systems kept running builds the loss figure from response and assessment costs. Keep the invoices.

Remedies and forum

The civil claim yields compensatory damages and injunctive or other equitable relief. (18 U.S.C. § 1030(g).) Because the claim arises under federal law, it can be filed in the Central District of California in Santa Ana or Los Angeles, and related state claims come along with it. Many businesses plead the CFAA together with a federal trade secret claim; our page on DTSA and CUTSA claims explains that pairing.

A court order barring further access, requiring return of credentials and data, and preserving logs can be obtained quickly on a strong showing.

Three situations we see

A terminated bookkeeper's remote desktop credentials remain active for three weeks. Logs show nightly logins and exports of vendor payment files. The claim is strong on both authorization and loss, given the forensic review.

A sales manager, still employed, exports her entire pipeline to a personal drive before giving notice. The CFAA claim is weak after Van Buren; the trade secret and Penal Code 502 claims carry the case.

What to bring to the first meeting

Bring the access logs, the dates credentials were issued and revoked, the acceptable use policy and any agreement the person signed, the forensic vendor's invoices and report, and a timeline of when the intrusion was discovered. If you have been accused, bring the complaint or demand letter and your own account of what access you had and when it ended; our page for someone accused of taking company data covers the defense side.

Frequently asked questions

Can a business sue under the Computer Fraud and Abuse Act?

Yes. Any person who suffers damage or loss from a violation may bring a civil action for compensatory damages and injunctive relief, provided the conduct involves one of the statutory factors. For most businesses that factor is at least $5,000 in loss within a one-year period. (18 U.S.C. § 1030(g), (c)(4)(A)(i)(I).) The suit must be filed within two years.

Does the CFAA apply to an employee who took data while still employed?

Usually not, after Van Buren. An employee who was permitted to access the files did not exceed authorized access by taking them for an improper purpose. (Van Buren v. United States (2021) 593 U.S. 374, 396.) The claim fits where access was revoked, where another person's credentials were used, or where the employee reached areas that were off limits.

What is the $5,000 requirement in a CFAA lawsuit?

The civil claim requires loss to one or more persons during any one-year period aggregating at least $5,000. (18 U.S.C. § 1030(c)(4)(A)(i)(I).) Loss includes the reasonable cost of responding to the intrusion, assessing the damage, and restoring the system, plus losses from any interruption of service. (18 U.S.C. § 1030(e)(11).)

Is the CFAA a criminal or civil law?

Both. It is a federal criminal statute, and it also authorizes a private civil action. We pursue the civil remedy for businesses; a criminal referral is the government's decision.

Talk to a California business litigation attorney

If someone has accessed your systems without permission, call (909) 235-6116 or contact us online before the logs are overwritten. Kolmogorov Law, P.C. is at 327 Magnet, Irvine, CA 92618, and pursues computer access and trade secret claims in Orange County, Los Angeles, and the Central District of California. See also our trade secret attorney page.

This page provides general information about federal and California law and is not legal advice. Outcomes depend on the access logs, the loss evidence, and the court.