One Friday evening, one of our clients called and informed us that their security systems had been penetrated and significant data had been breached. Millions of records had been obtained, and a cybertheft ring had actually set up an online auction offering a live portal into the client’s network. Immediately, we—together with our client’s corporate counsel—began work over the weekend in order to prepare and file a series of federal complaints under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. The objective was to immediately identify the culpable party and stop the data penetration. We followed a series of “middlemen” until we found the source of the breach and, working side by side with a team of computer technicians, the security hole was patched and the vulnerability eliminated. Immediate action and strategic relationships were the key to our success.
Data breaches such as this one are far too common these days. When a serious data breach like this occurs, most companies want to make sure they (1) quickly resecure their data to avoid any further breach; (2) avoid a major negative impact to reputation and existing clients; (3) comply with their legal disclosure obligations; and most important, (4) limit or eliminate any liability.
