The chapter examines the distinction between public and private cyberattacks and responses to them in domestic law (e.g. application of criminal law) and international law (e.g. self-defence and countermeasures). After describing the different purposes, nature, and effects of cyberattacks committed by public and private actors, it argues that the determination of whether a particular cyberattack is of a public or private nature should define how states respond to cybersecurity risks. It then argues that the existing domestic and international law frameworks regulating cyberattacks suffer from serious limitations and proposes a holistic approach for responding to cyberattacks, taking into account the difference between public and private cyberattacks.