Discussions below explain the mistakes in the examples given, which err in mistaking essential and nonessential clauses and vice versa. A revision accompanying each sample sentence demonstrates correct form.
An essential (or restrictive) word, phrase, or clause is one that is necessary for conveying the intended meaning of a sentence. When the essential element follows the core of the main clause, the conjunction that serves as the link between them. By contrast, a nonessential (or nonrestrictive) word, phrase, or clause is attached to the main clause, trailing a comma and the conjunction which. (Alternatively, nonessential elements are inserted parenthetically into the sentence with commas, dashes, or parentheses, but this post does not pertain to that type of sentence construction.)
Actually, that and which are interchangeable as conjunctions preceding essential elements, but some writing handbooks advocate using only that in such cases to avoid confusion with sentences with nonessential elements, for which which is the only correct conjunction. In American English, at least, many careful writers observe this distinction, a strategy I strongly recommend.
The writers of the two examples below have, in constructing the sentences, confused essential and nonessential clauses, as explained in the discussion following each statement.
She faulted him for criticizing the Dodd-Frank Act that sought to overhaul the US financial sector following the recession.
The wording of this sentence suggests that of various Dodd-Frank acts, the one in question is the one that sought to overhaul the US financial sector following the recession, and therefore the description of the intent of the act is essential, because it pertains to this Dodd-Frank Act. But the part of the sentence that follows that describes the intent of the only existing Dodd-Frank Act. Therefore, the clause that begins with sought provides additional information that should be appended to the main clause, “She faulted him for criticizing the 2010 Dodd-Frank Act,” with a comma and the conjunction which: “She faulted him for criticizing the 2010 Dodd-Frank Act, which sought to overhaul the US financial sector following the recession.”
More than 60 percent of companies have suffered a cybersecurity compromise in the past year, which exposed confidential information and disrupted systems and operations.
Setting the modifying phrase “exposed confidential information and disrupted systems and operations” off as a subordinate clause beginning with which creates the mistaken impression that the fact that a majority of companies experienced a hack during the previous year had the unfortunate results specified. But the phrase pertains to individual cybersecurity compromises, not to the preponderance of such experiences. The phrase is essential to the sentence—it describes hacking incidents that had specific results—and so should be integrated into the main clause, as shown here: “More than 60 percent of companies have suffered a cybersecurity compromise in the past year that exposed confidential information and disrupted systems and operations.”
In the revised sentence for the second example, the phrase “in the past year” distracted me. Can that phrase remain in its position between “a cyber-security compromise” and “that exposed confidential information and disrupted systems and operations” without suggesting that the latter describes the year and not the compromise?