Companies must pay closer attention to what they say after hackers strike, lawyers warn, as regulators crack down on inaccurate disclosures and Congress debates mandatory reporting of cybersecurity breaches.

Several regulatory actions in recent weeks have focused on breach notifications, media statements and investor communications issued by companies after incidents that watchdogs say were deceptive.