Cybercrime Lawyers & Cyber Investigators
Counsel to individuals, family offices, businesses and insurers after a cyber incident: hacked accounts and devices, ransomware, fraudulent wires, stolen digital assets and third-party breaches.
Attorneys who have arbitrated cybercrime disputes since 2019, working alongside forensic investigators from retired federal law enforcement. We establish what happened, preserve the proof and recover what can be recovered.
The first question is not who to sue. It is what happened.
A client knows that money, data or an account is gone. What is not yet known is how, and whose safeguard failed: the victim’s, a bank’s, a carrier’s, or a vendor’s the victim never heard of.
Banks, platforms and insurers will answer that question in their own favor unless someone answers it first with evidence. So our investigators go first: devices imaged, access logs pulled, funds traced, timeline fixed.
The legal strategy follows the record. The same discipline serves insurers and companies on the other side of a claim.
Investigators who have worked these cases from the other side.
Most firms hire a forensic vendor after the client calls. Ours works with a standing team, so investigation and legal strategy start together.
Retired federal law enforcement, now working for the victim.
Retired federal investigators and analysts who spent their careers on cyber and financial crime. They handle device and network forensics, blockchain and bank tracing, dark web monitoring and, when a client decides it is necessary, contact with extortion actors.
They coordinate with the FBI, Secret Service and prosecutors they once worked alongside.
Lawyers who have arbitrated cybercrime disputes since 2019.
Counsel of record in more than 130 arbitrations before AAA, JAMS and NAM, most arising from cybercrime and account takeovers, often against publicly traded carriers, exchanges and banks.
AI-assisted review handles the logs, platform records and policy files these cases produce. We try them on the evidence.
Every stage of a cyber incident, from the first hour to the final award.
For private clients, family offices, businesses, fiduciaries and insurers in New York and nationwide.
Cyber Investigations & Digital Forensics
Privileged investigation of hacks, account takeovers and insider misconduct, with evidence preserved for insurers, regulators and tribunals.
Ransomware Representation & Negotiations
Counsel to boards, companies and families facing ransomware and data extortion: containment, sanctions review, negotiation through experienced intermediaries, regulatory notices.
Cyber Insurance Coverage & Litigation
Claims under cyber, crime and funds-transfer-fraud policies, coverage litigation for policyholders, and coverage evaluation for insurers.
Hacked Devices & Network Investigations
Forensic imaging of compromised phones, laptops, networks, email tenants and cloud accounts, including spyware and insider access.
Wire Fraud & Business Email Compromise
Recall and freeze requests, FBI Kill Chain coordination, attribution of the compromised mailbox, and claims against banks and counterparties who failed to verify.
Account Takeovers, SIM Swaps & Crypto Theft
Arbitration and litigation against carriers, exchanges, banks and custodians after SIM swaps and unauthorized transfers, with on-chain tracing and freezes.
Third-Party Liability & Vendor Breaches
Claims against vendors, identity providers and outsourcers whose failures exposed people who were never their customers, and defense of companies facing such claims.
Cybercrime in 2025, by the FBI’s numbers.
The FBI’s Internet Crime Complaint Center keeps the most complete public record of reported cybercrime. These are its 2025 figures.
3,611 ransomware and 89,129 extortion complaints in 2025. Reported ransomware losses of $32 million exclude downtime, recovery and legal costs, which are usually far larger.
Fourth among the states in 2025: 45,255 complaints and $1.23 billion in losses. New York adds its own notice rules, described below.
The FBI’s Recovery Asset Team froze $679 million of $1.16 billion in reported fraudulent transfers in 2025, a 58 percent success rate. Those results depend on fast, complete reporting.
Complainants over 60 lost $7.7 billion in 2025, up 59 percent. Investment fraud, much of it crypto-based, cost $8.6 billion.
Private wealth is targeted deliberately.
Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; N.Y. General Business Law § 899-aa; 23 NYCRR Part 500, § 500.17.
Investigate. Respond. Recover.
Incident investigation and evidence preservation
Scope the intrusion, preserve logs and devices before they are overwritten, and send preservation demands to carriers, platforms and vendors.
Device, network and account forensics
Imaging and analysis of phones, computers, email tenants and cloud accounts to identify malware, unauthorized access and the credential or integration that was abused.
Ransomware and extortion response
Privileged incident management, sanctions review of any payment, negotiation through experienced intermediaries, and the regulatory and insurer notices that follow.
Fraud recovery and law-enforcement coordination
Bank recalls, IC3 and Recovery Asset Team reporting, exchange and stablecoin-issuer freezes, restraining orders in New York courts, and law-enforcement referrals.
Cyber insurance claims and coverage litigation
Notice and proof of loss under cyber, crime and funds-transfer-fraud coverage, negotiation with adjusters, and litigation when coverage is denied. Coverage evaluation for insurers.
Claims against responsible third parties
Arbitration and litigation against carriers, exchanges, banks, vendors and identity providers whose failures enabled the loss. Defense of companies and fiduciaries facing such claims.
Related pages: SIM-Swap & Account Takeover · Forensics & Investigation · AI Extortion Incident Response · Cybercrime Arbitration for High-Net-Worth Clients · Cybercrime Defense for Families · Arbitration
After an incident, the law starts counting.
Regulators, insurers and the public each expect notice on their own schedule. Missing one can cost coverage or invite enforcement.
72 hours
Companies licensed by the New York Department of Financial Services must notify the Superintendent within 72 hours of determining that an incident occurred, including at an affiliate or vendor.
23 NYCRR § 500.17(a)4 business days
A U.S.-listed company must disclose a material cybersecurity incident on Form 8-K, Item 1.05, generally within four business days of the materiality determination.
SEC cybersecurity disclosure rules (2023)30 days
Under the SHIELD Act, a business that discovers a breach of private information must notify affected New Yorkers within 30 days, and also the Attorney General, Department of State and State Police.
General Business Law § 899-aaA DFS-regulated company that pays an extortion demand must notify the Superintendent within 24 hours and justify the payment within 30 days (23 NYCRR § 500.17(c)). Ransom payments to sanctioned persons can violate U.S. sanctions law regardless of intent (OFAC Ransomware Advisory, 2021). Insurance policies add their own notice conditions.
Six steps, run in parallel where the clock requires.
The order is logical, not sequential. In a live incident, containment, preservation and recovery run at the same time.
Triage and containment
Identify what the attacker still controls and cut it off: account locks, credential resets, carrier and exchange holds, device isolation.
Preservation and forensic imaging
Devices are imaged and audit trails exported. Preservation demands go to every carrier, platform and vendor before retention periods erase the record.
Attribution: whose system failed
The forensic team establishes how the intrusion happened and which control failed. That answer decides coverage, liability and the strength of any claim.
Recovery channels
Bank recalls, FBI Recovery Asset Team requests, blockchain tracing and exchange freezes. Where a defendant can be identified, restraining orders and asset freezes.
Claims and disputes
Insurance notice and proof of loss, demands to responsible third parties, and arbitration or litigation when they refuse. Large record sets are handled with secure AI-assisted review.
Monitoring and hardening
Dark web monitoring for leaked credentials and data, and planning with the family office or company so the same door is not open twice.
Investigators, negotiators and analysts on call.
A standing network, engaged under privilege through the firm.
Retired federal investigators
Former federal agents and analysts who lead investigations and coordinate with current law enforcement.
Digital forensic examiners
Certified examiners for phones, computers, networks and cloud tenants, producing reports that meet evidentiary standards.
Blockchain tracing analysts
Tracing stolen cryptocurrency across chains, mixers and exchanges, formatted for freeze requests and court filings.
Ransomware negotiators and dark web intelligence
Intermediaries for extortion communications, threat-actor profiling and monitoring of leak sites and criminal markets.
Insurance and damages specialists
Forensic accountants and coverage consultants who quantify loss and test insurer positions.
Incident response engineers
Security engineers who contain active intrusions, rebuild environments and document remediation.
The first 72 hours decide what can be recovered.
Recalls, freezes and FBI recovery requests depend on speed and on undisturbed evidence.
- Call the bank, exchange or carrier and ask for a recall, hold or lock; note the time and name
- Report to the FBI at ic3.gov with exact amounts, accounts, wallet addresses and dates
- Leave the compromised device as it is; change passwords from a clean device
- Keep every email, text, screenshot and transaction confirmation
- Notify your insurer in the form the policy requires, after counsel reviews the notice
- Engage counsel so the investigation is privileged from the start
- Wipe, reset or keep using a device you believe is compromised
- Pay a ransom or a “recovery service” without legal advice
- Communicate with the attacker outside a controlled channel
- Give recorded statements about how the loss happened before the facts are established
- Assume the loss is unrecoverable because the first person you called said so
From the firm’s cybercrime writing.
Published guidance for victims, boards, insurers and their advisers.
Ransomware Payment Legal Risks in the First 72 Hours.
Sanctions exposure, regulatory notices and insurer conditions before any payment decision.
Read the articleDark Web Surveillance for Private Clients.
How leaked credentials are used to target families, and what monitoring can and cannot prevent.
Read the articleSIM-Swap Arbitration Win Against T-Mobile.
How account records and authentication logs decided a carrier arbitration.
Read the articleFrequently asked.
Three things, usually at once. Direct a privileged investigation so the facts are established by professionals, not by the bank or platform that may be at fault.
Run the recovery: recalls, freezes, law-enforcement reporting and insurance claims. Then pursue the party whose failure allowed the loss.
The FBI and New York regulators recommend against it, and payment does not guarantee data is restored or kept private. Some organizations still conclude they have no alternative.
That decision carries sanctions exposure, DFS reporting and insurer consent requirements. We help boards decide on a full record and document the diligence regulators will ask about.
It depends on the policy and how the loss is characterized. Cyber, crime and funds-transfer-fraud coverages insure different events, with different sub-limits and conditions.
Insurers often deny because the transfer was “voluntary,” the breach was a vendor’s, or notice was late. The forensic record decides which of those positions survive.
Potentially, yes. Breaches often run through identity providers, login integrations and vendors whose failures expose people who have no account with them.
In the 2026 Dropbox and Lenovo ID incident, an identity registered with one company opened accounts at another, and many victims had never been its customers. Whether a claim exists depends on what the vendor represented and what the forensic record shows.
Sometimes, and speed is decisive. In 2025 the FBI’s Recovery Asset Team froze $679 million of $1.16 billion in reported fraudulent transfers.
Beyond recalls, recovery may come from a bank that should have questioned the transfer, a counterparty whose email was compromised, or insurance. Each depends on proving whose system failed.
Our forensic examiners do, under privilege. They image the device without altering it, identify malware or unauthorized access, and document what was taken and when.
Law enforcement cannot take every case. A private examination is often the only way to learn what happened.
Because the terms of service of carriers, exchanges, banks and platforms almost always require it. The claim is decided under AAA, JAMS or NAM rules, not by a jury.
Discovery is narrower, so evidence gathered before filing matters more. See our arbitration practice.
Yes. Insurers retain us to evaluate coverage and causation. Companies retain us when a breach is alleged to have started in their systems, or a board needs independent counsel on an extortion demand.
We screen for conflicts before any engagement.
Hacked, extorted or defrauded? Start with the facts.
Call for a confidential consultation. We will tell you what can be preserved, what can be recovered and who should answer for it.