Plaintiffs seeking to file class-action lawsuits arising out of a cybersecurity event will have a high bar to clear with the passage of HB2434, a new law in Tennessee which restricts entities from being held liable absent “willful and wanton misconduct” or “gross negligence.” Tennessee has joined the ranks of a small, but growing number of states to pass legislation providing some relief to organizations after they are victimized by cybercriminals.