In the first 24 hours after a suspected data breach, a law firm should contain the problem, preserve evidence, bring in the right help, notify its cyber insurance carrier, and begin evaluating its legal and ethical notification duties. Acting quickly and in the right order protects clients, limits damage, and keeps options open.
Below is an hour-by-hour guide. Every incident is different, so treat this as a framework, not a script.
Hour 0 to 1: Recognize and Contain
Breaches often start with a small clue: a client asking about an email you didn't send, a ransom note on a screen, or a strange login alert.
- Don't panic, and don't start deleting things. Deleting emails or wiping computers can destroy evidence you'll need later.
- Isolate affected devices. Disconnect them from the network by unplugging the network cable or turning off Wi-Fi. Leave them powered on if possible.
- Reset compromised passwords from a device you know is clean, and turn on multifactor authentication if it isn't already enabled.
- Write down what you've seen, including times, screens, and messages.
Hour 1 to 3: Assemble Your Response Team
Call the people who need to be involved right away:
- Managing partner or designated incident lead.
- Your IT provider or security team, to help investigate and contain.
- Your cyber insurance carrier. Many policies require prompt notice and may require you to use approved breach counsel and forensic firms. Calling the wrong vendor first can affect coverage.
- Breach counsel, often provided through your insurer, to guide legal decisions and help protect privilege over the investigation.
Keep the group small and communicate by phone if email may be compromised.
Hour 3 to 8: Preserve Evidence and Investigate
Forensic investigators will want to know how the attacker got in, what they accessed, and whether they're still present. Help them by preserving:
- System and email logs.
- Affected computers, untouched.
- Suspicious emails, with headers intact.
- Records of mailbox rule changes and sign-in history.
- Any ransom notes or attacker communications.
If ransomware is involved, do not contact the attackers or pay a ransom without guidance from counsel and your insurer. Payments can raise legal issues, and payment doesn't guarantee data recovery. CISA's StopRansomware site offers federal guidance, and our article on preventing ransomware covers how to reduce future risk.
Hour 8 to 16: Keep the Firm Running
Clients still need representation while the investigation continues.
- Identify court deadlines and filings due in the next several days.
- Decide whether to request extensions where appropriate.
- Set up temporary, secure communication if firm email is unavailable.
- Restore critical systems from clean backups once investigators approve.
This is where a business continuity plan pays off. Firms with one can keep serving clients while recovery happens.
Hour 16 to 24: Evaluate Notification Duties
Notification is where legal and ethical obligations come together. With counsel, consider:
- Client notification. ABA Formal Opinion 483 discusses lawyers' duties after a data breach, including the obligation to inform current clients when their information may have been compromised. Check your state's rules of professional conduct and ethics opinions.
- State breach notification laws. Utah's Protection of Personal Information Act and the laws of other states where affected people live may require notice to individuals and, in some cases, to state authorities, within set timeframes.
- Contractual obligations. Some clients, especially businesses and healthcare organizations, have agreements requiring notice.
- Law enforcement. Reporting to the FBI through ic3.gov is often recommended.
You may not have all the facts within 24 hours, and that's normal. The goal is to start this evaluation early so deadlines aren't missed.
Common First-Day Mistakes
- Wiping and rebuilding computers before evidence is collected.
- Hiring a forensic firm before calling the insurance carrier.
- Communicating about the breach over compromised email.
- Making public or client statements before facts are known.
- Assuming the attacker is gone after changing one password.
Prepare Before You Need It
The best time to plan for a breach is now. A one-page incident response plan should list your insurance carrier's claim number, breach counsel contact, IT provider contact, and who leads the response. Keep a printed copy somewhere outside the office network.
Maise Technology helps law firms prepare for and respond to security incidents through our cybersecurity services. Have questions about building your firm's response plan? Get In Touch.
This article is for general information and is not legal advice. Consult qualified counsel about your firm's specific obligations after a security incident.
