When data is breached, contested, or misused, the first hours decide the case. We act as breach counsel and trial counsel together, so forensics, notification, regulators, and the class actions that follow are managed under one partner and one privilege.
A GDPR controller has 72 hours from becoming aware to notify its supervisory authority, a public company four business days from deciding an incident is material to file its Form 8-K, and a HIPAA-covered entity 60 days from discovery to notify the people affected. Illinois adds notice to its Attorney General above 500 residents. The clocks start on discovery, not when the forensic report is finished.
That report is the plaintiffs' first document request. Courts have ordered it produced where the vendor was on contract to the company before counsel engaged it, where it went to the board, the auditors and the regulators, or where it was written to run the remediation rather than to advise counsel; the engagement letter and the distribution list are drafted for the judge who will read them.
Under Illinois' biometric privacy act a plaintiff need show no injury beyond the violation, has five years to sue and, since the 2024 amendment, recovers once per person rather than once per scan. A ransom paid to a sanctioned actor is a sanctions violation whatever the payer knew, so screening precedes the negotiator's first call.
Breach counsel from the first hours. We direct the forensic investigation under privilege, triage the exposure, and prepare for the litigation and regulatory inquiries that so often follow a security incident.
Defense of companies in data-breach and privacy class actions. We challenge standing and class certification, manage discovery and expert proof, and build the defense around what the claims can actually sustain.
Representing clients in matters before regulators such as the FTC and state attorneys general arising from data and privacy incidents, coordinating with locally admitted counsel where a foreign data-protection authority is in play.
Prosecuting and defending trade-secret theft and data-misappropriation claims under the Defend Trade Secrets Act and state law. The cases involve departing employees, vendor leaks, and competitor incursions, and they often begin with emergency injunctive relief.
Litigating claims under privacy and biometric statutes such as the CCPA and BIPA, alongside common-law negligence and consumer-protection theories, where overlapping frameworks have to be reconciled into one coherent defense.
Mapping breach-notification obligations across states and regulators, preserving privilege over the investigation, and managing digital evidence and chain of custody so the early record supports the defense rather than the plaintiffs.
California's data-breach private right of action requires 30 days' written notice before statutory damages are sought, and a business that cures within that window cuts off the statutory claim, though improving security afterward does not count as a cure. Illinois' breach-notification law has no such window, and its biometric act has none at all.
In federal court a plaintiff whose data was taken but not misused must show a concrete injury, and the circuits divide on whether the risk of future fraud and the cost of credit monitoring suffice. Illinois courts hold that a biometric-privacy plaintiff is aggrieved by the violation alone. The forum decides which rule applies.
Many incidents begin at a vendor, and the contract decides who notifies, who pays for forensics and credit monitoring, and whether the indemnity survives the liability cap. Under HIPAA a business associate must report a breach to the covered entity within 60 days of discovery, and many agreements shorten that to days.
A company licensed by New York's Department of Financial Services must notify it within 72 hours of a cybersecurity event, report an extortion payment within 24 hours and explain within 30 days why it was necessary. A non-bank financial institution must tell the FTC within 30 days when 500 or more consumers are affected.
The Defend Trade Secrets Act gives three years to sue, allows ex parte seizure in extraordinary circumstances, and denies an employer exemplary damages and fees against an employee whose contract lacks the Act's whistleblower-immunity notice. The notice is a paragraph long and has been required since 2016; opposing counsel checks for it first.
The duty to preserve attaches when litigation is reasonably anticipated, for a breach usually the day it is confirmed. Logs on a short retention cycle, the attacker's artifacts and system images must be captured before remediation wipes them; under Rule 37(e) a court finding intent to deprive may presume the lost evidence was unfavorable.
Counsel engages the forensic firm before the first image is taken, so the investigation runs at the direction of lawyers rather than the IT department. The scoping letter written in hour one decides if the forensic report is work product or Exhibit A.
While forensics establishes what was accessed, we chart which state statutes, sector regulators, and foreign authorities the affected data triggers, and we sequence the disclosures so that no notice contradicts another or concedes a fact the complaint will later quote.
FTC and state-AG inquiries arrive alongside the first class complaints. Every regulatory submission is drafted with the civil docket in view, where standing and Article III injury are contested at the threshold and certification is fought on the individualized facts of who was actually harmed.
With exposure quantified per statute and per class, the matter resolves by dispositive motion, structured settlement, or trial, and the remediation record kept since day one becomes the evidence that the company has already answered for the incident.
The forensic report is either privileged or it is the plaintiffs' strongest exhibit, and that is decided in hour one.
Three streams of dispute that share one set of facts. The first is the data-breach case: negligence, contract and state consumer-protection claims, usually as a class action, in which standing and the duty of care are fought before anything else. The second is the privacy-statute case, where a law such as Illinois' biometric act or California's privacy act supplies its own cause of action and its own damages, often without any breach at all. The third is misappropriation: a departing employee, a vendor or a competitor who took data they were not entitled to, pursued under the Defend Trade Secrets Act and state law. All three turn on logs, images and chains of custody, and on who controlled the forensic investigation.
In the first 72 hours: engage the forensic firm under counsel's letter so the investigation is privileged, notify the cyber carrier and confirm its consent requirements before vendors or a negotiator are retained, and run sanctions screening before anyone speaks to the attacker. Then the preservation order for logs and images, the notification map across the states, sector regulators and foreign authorities the data triggers, and, for a public company, the materiality analysis that starts the four-business-day clock. Law enforcement is contacted when it helps, and the board is briefed in writing drafted in the knowledge that it will be produced. Each of those steps is taken by the lawyers who will defend the claims that follow.
Yes, and the defense has a shape. Standing comes first in federal court, where a plaintiff must show concrete injury rather than exposure alone. The pleading motion then tests whether a duty of care exists under the state's law and whether the economic-loss doctrine bars a negligence claim for money alone. At certification, a nationwide class built on the negligence law of fifty states rarely survives predominance, and the damages theories, among them the price of credit monitoring, time spent and the diminished value of personal data, are tested for whether they can be measured classwide. Settlements, when they come, are usually claims-made funds with credit monitoring attached, and the claims rate shapes the real cost far more than the headline number.
Yes. A state attorney general's inquiry typically asks for the notification letters and their timing, the security program as it stood before the incident and the forensic conclusions, and in a multistate matter one lead state usually negotiates for the group. The FTC proceeds under its unfairness authority on the theory that inadequate security is itself an unfair practice, and resolves most matters by consent order with a 20-year term. For health data, the Office for Civil Rights resolves matters through resolution agreements with corrective action plans. We represent the company, not the agency, we coordinate with locally admitted counsel where a foreign data-protection authority is involved, and every submission is drafted knowing the plaintiffs will read it.
Speed and proof. These disputes usually begin with a departing employee, a vendor leak or a competitor's hire, and the first filing is often a motion for a temporary restraining order, which under Rule 65 can issue within days and last 14, while forensics reconstructs what was copied, when and to where. The Defend Trade Secrets Act allows three years from discovery to sue and, in extraordinary circumstances, an ex parte seizure of the devices; the Illinois Trade Secrets Act allows five years. An injunction under the federal Act cannot bar a person from taking a job and must rest on evidence of threatened misappropriation rather than on what the person knows. We prosecute and defend these claims with the digital evidence preserved correctly from the first day.
Because the failures come from the seams. A forensic firm engaged by the IT department before counsel arrives produces a report the plaintiffs will read. A notification letter that says there is no evidence of misuse becomes an exhibit when the forensic findings say otherwise three weeks later. A materiality decision for the 8-K made without the breach team, or an attorney general's notice filed on a different timeline from the customers', hands the other side a contradiction. And an insurer whose consent was not sought before the negotiator was hired can decline the bill. One partner holding forensics, notification and the civil docket together is how those seams are closed, and it is the only way the privilege established in hour one survives to trial.
Protection and enforcement of intellectual property rights, trade secrets, and proprietary information through litigation and dispute resolution.
Explore →Trial advocacy for complex business disputes, including contract breaches and commercial conflicts in state and federal courts.
Explore →Representation in employment disputes, including discrimination and wrongful-termination claims and the resolution of workplace conflict.
Explore →Arbitration, mediation, and other alternative dispute resolution for conflicts where the business relationship is worth keeping.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.