SKIP TO CONTENT
An organization may experience a data privacy and security incident at any time of day. It is imperative that immediate action is taken in order to mitigate the legal, financial, reputational, and other risks posed by such an incident. Our global Incident Response practice provides 24/7/265, comprehensive, and real-time legal counsel to organizations across all industry sectors and from all geographic footprints in their response to data privacy and security incidents such as ransomware attacks, business email compromises (BECs), vendor breaches, inadvertent disclosures, and other types of unauthorized network intrusions. From initial incident detection and containment, through notification, and disclosure, we guide our clients through every phase of the incident response process and beyond.
With unmatched experience and knowledge, our incident response expertise is unparalleled. We are equipped to effectively and efficiently guide organizations through complex and ever-changing legal, regulatory, and operational issues that arise during an incident response – ensuring compliance with applicable data privacy and breach notification laws, regulations, and guidance, all under attorney-client privilege. Our team seamlessly integrates legal and technical incident response strategies, working closely with internal stakeholders, digital forensics and incident response (DFIR) firms, law enforcement, cyber insurers and brokers, and communications teams to coordinate a compliant, effective, and defensible response.
Our international Incident Response team is available 24/7/365 to respond to data privacy and security incidents across multiple jurisdictions, time zones, and languages. If you suspect your organization is currently experiencing a data privacy and security incident, contact our 24/7/365 Incident Response hotline at (+1) 844-885-1574 (U.S.) or (+44) 808 502 0579 (UK), or via email at .
What is Breach Counsel?
As Breach Counsel, we serve as the lead legal advisor during and after a data privacy and security incident. Engaged directly by the impacted organization, we manage the full lifecycle of the investigation and response to an actual or suspected data privacy and security incident, including:
- Engaging and directing external stakeholders assisting in the response (e.g., DFIR firms and other technical experts);
- Liaising with law enforcement to obtain intelligence supportive of the incident response process;
- Evaluating notification obligations under applicable state, federal, and international laws, as well as contracts and regulations;
- Communicating with, and disclosing the incident (if applicable) to, required individuals, business partners, regulators, and media, among others as identified or necessary;
- Preserving evidence, assessing liability, and preparing for regulatory investigation and/or litigation; and
- Ensuring response efforts address legal, regulatory, and contractual requirements related to the incident and investigation.
Our involvement from the outset enables organizations to quickly identify, contain, and respond to the incident, maintain control of sensitive findings, and make informed, risk-based decisions about the incident and its response, all under legal privilege.
Representative Experience
- Led incident response efforts on behalf of a large reinsurer in connection with a network intrusion incident resulting in the exposure of over one (1) million records owned by hundreds of its customers.
- Led incident response efforts on behalf of a national payroll company in connection with a network intrusion incident impacting the security of data relating to its customers’ current and former employees.
- Led incident response efforts on behalf of global law firm in connection with a ransomware incident impacting the security of client data and causing a disruption in the firm’s operations.
- Managed incident response efforts, in coordination with U.S. state and federal law enforcement, on behalf of a healthcare organization in connection with rogue employee conduct.
- Led incident response efforts on behalf of a national chain restaurant in connection with a credit card incident that impacted over 20 locations and approximately one (1) million cardholders.
- Led incident response efforts on behalf of a Fortune 500 organization in connection with a large-scale ransomware incident.
- Led incident response efforts on behalf of a global software company in connection with an incident impacting over 20 million users.
- Led incident response efforts on behalf of a national insurance broker in connection with a BEC incident impacting several email accounts containing sensitive information.
- Led incident response efforts on behalf of a state governmental entity in connection with a sophisticated advanced persistent threat (APT) attack.
- Led incident response efforts for several defense contractors in connection with sophisticated data theft compromises.
- Managed incident response efforts on behalf of multiple colleges and universities in connection with ransomware and data extortion incidents.
- Led incident response efforts on behalf of a large university with a worldwide student and alumni population in connection with the inadvertent disclosure of alumni information including names and Social Security numbers.
- Managed incident response efforts on behalf of banks, credit unions, and other financial institutions in connection with ransomware and data extortion incidents.
- Led incident response efforts on behalf of a national chain restaurant in connection with credit card incident that impacted over 90% of its locations and millions of cardholders.
- Led incident response efforts, including notification to requisite individuals and regulatory authorities, on behalf of an international non-profit foundation in connection with the disclosure of certain private and confidential information.
- Coordinated incident response efforts pursuant to the Health Insurance Portability and Accountability Act (HIPAA), the Federal Trade Commission’s (FTC) Health Breach Notification Rule, and U.S. state law on behalf of a healthcare organization in connection with a network intrusion incident impacting over five (5) million records.
- Led incident response efforts on behalf a professional sports team in connection with the inadvertent disclosure of tax information of current and former players, coaches, and other staff.
- Led incident response efforts on behalf of a global background screening company in connection with the employee theft of a laptop containing over 100,000 records and other sensitive data.
- Led incident response efforts on behalf of nationwide residential management company in connection with a compromise in the security of over 55 boxes of paper records collected over thirty years relating to current and former tenants, applicants, and employees.
- Led incident response efforts on behalf of an accounting firm in connection with a stolen unencrypted laptop containing information relating to hundreds of clients and thousands of clients’ current and former employees.
- Led incident response efforts on behalf of a global financial institution in connection with nearly 10 years of unauthorized flow of data relating to over two (2) million customers between and a former third-party vendor.
- Led incident response efforts on behalf of a large regional financial institution in connection with the theft of an unencrypted laptop containing the names, Social Security numbers, and account information for almost the entire customer population.
- Led incident response efforts on behalf of a healthcare organization in connection with a malicious hacking event that resulted in the unauthorized disclosure of health information relating to approximately six (6) million individuals.