Any person whose property or person is injured by reason of a violation of the provisions of the Virginia Computer Crimes Act (§ 18.2-152.1 et seq.) may sue and recover damages as provided in § 18.2-152.12. An action shall be commenced before the earlier of (i) five years after the last act in the course of conduct constituting a violation of the Computer Crimes Act or (ii) two years after the plaintiff discovers or reasonably should have discovered the last act in the course of conduct constituting a violation of the Computer Crimes Act.
§ 8.01-40.1.Action for injury resulting from violation of Computer Crimes Act; limitations.
Chapter 3. Actions · Article 3. Injury to Person or Property · Last amended 1985 · Last verified July 16, 2026
In one sentenceLets a person injured by a violation of Virginia’s Computer Crimes Act sue for damages, and requires the suit to be filed before the earlier of five years after the last violating act or two years after the plaintiff discovered or reasonably should have discovered it.
Full Text of § 8.01-40.1
Plain-English Summary
Anyone whose property or person is injured by a violation of the Virginia Computer Crimes Act may sue and recover damages as provided under that Act. The civil remedy this section creates rides on top of the criminal statute rather than replacing it.
The section sets a two-part deadline for filing suit, and whichever comes first controls: five years after the last act in the course of conduct that violated the Computer Crimes Act, or two years after the plaintiff discovers, or reasonably should have discovered, that last act. A plaintiff who learns of the violation quickly generally faces the shorter two-year window; the five-year outer limit matters most when discovery is delayed.
Frequently Asked Questions
What underlying law does this civil action enforce?
The Virginia Computer Crimes Act. A person whose property or person is injured by a violation of that Act may sue and recover damages as the Act provides.
How long do I have to file suit after a computer crime happens?
Before the earlier of five years after the last act in the course of conduct constituting the violation, or two years after you discover or reasonably should have discovered that last act.
What if I do not discover the computer crime until years later?
The two-year discovery-based deadline runs from when you discover or reasonably should have discovered the last violating act, but the suit still must be filed within the outer five-year limit from that last act.
How are damages calculated in a case brought under this section?
The section incorporates the damages provided under the Virginia Computer Crimes Act itself, rather than setting out a separate damages formula.
Does a criminal conviction have to happen first before I can sue?
The section does not condition the civil action on a prior criminal charge or conviction; it requires only that a violation of the Computer Crimes Act caused the injury.
Amendment History
1985, c. 92.
Source & verification. Section text and amendment history are
reproduced verbatim from the Code of Virginia, published by the
Code of Virginia, Virginia Division of Legislative Automated Systems. Last verified July 16, 2026.
· Official source
Also known as: virginia computer crimes act civil lawsuit8.01-40.1 computer crimes damageshacking lawsuit statute of limitations virginiava code civil action computer fraudtwo year discovery rule computer crimes virginia