Data, Privacy & Cyber Incident Response
A privacy program built for the states you sell into. Security commitments you can actually keep. A plan for the day they are tested.
When it happens, we coordinate the forensic firm, the insurer, the notifications and the regulators, and we move on the money if money moved.
After a breach, the question is whose system failed and what you promised.
Every incident becomes two questions. What did your contracts and policies promise about security and data, and did you keep those promises. Then, who else touched the system: a vendor, a payment processor, a cloud provider, an employee.
New York requires reasonable safeguards for private data and notice to affected residents within 30 days of discovering a breach. Other states have their own clocks. Enterprise customers have theirs, written into the data processing addendum.
Our cybercrime practice has worked these cases from the victim’s side for years. We bring that to the planning, so the promises are ones you can keep and the response is one you have rehearsed.
The figures behind the risk.
Current numbers from the FBI and the statutes that set the clocks.
New York’s safeguards duty scales for small businesses, defined as fewer than 50 employees, under $3 million in annual revenue or under $5 million in assets. Financial companies under the FTC Safeguards Rule notify the FTC within 30 days of a breach affecting 500 or more consumers. California’s updated privacy regulations, effective January 1, 2026, add risk assessments and annual cybersecurity audits for certain businesses. Sources: FBI, 2025 Internet Crime Report; FBI press release on the 2025 report; New York General Business Law § 899-aa; New York General Business Law § 899-bb; SEC, cybersecurity incident disclosure compliance guide; FTC, Safeguards Rule; California Privacy Protection Agency, CCPA regulations.
What we do on privacy and security.
Privacy program and policies
A privacy policy that describes what the product does, internal data handling rules, retention schedules and the rights requests process for the states you sell into.
Security and data terms
Security commitments in customer agreements and data processing addenda that match your actual controls, with breach notice timing you can meet.
Incident response plan
Who calls whom in the first hour, counsel first so the work is privileged, a pre-selected forensic firm, insurer notice steps and a communications plan.
Breach response
Forensic coordination, legal analysis of what was accessed, notification duties by state and contract, regulator correspondence and customer communications.
Wire fraud and account takeover
Business email compromise, diverted payments and takeovers of business accounts. Bank and law enforcement engagement in the first hours, and recovery against the parties whose systems failed.
Third-party and vendor risk
Security terms for the vendors who touch your data, review of their incident obligations and the allocation of loss when their system is the one compromised.
How an incident runs when the plan exists.
The first hours decide what can be recovered and what must be disclosed.
Hour one
Counsel engaged, systems preserved, insurer on notice, forensic firm retained under privilege.
Day one
Scope of access established, money movement traced, banks and the FBI engaged if funds moved.
Week one
Notification duties determined by state, contract and regulator, and notices drafted and sent on time.
After
Root cause, vendor claims, contract and control changes, and the record you will need if a claim follows.
We draft it. We also defend it.
Fintech and digital assets since 2017.
Max Dilendorf has advised fintech, payments and digital-asset companies since 2017, through the growth of the sector and the regulation that followed. The questions founders ask today about AI, we have worked through before with crypto.
More than 130 arbitrations since 2019.
Software liability, platform and payment disputes, cybercrime losses and AI-related claims before the AAA, JAMS and NAM, and emergency relief in New York courts. What we learn in those rooms shapes how we draft.
Preserve first. Call counsel second. Announce last.
The order matters more than the speed of any single step.
- Preserve logs and images of affected systems before anyone rebuilds
- Call counsel before the forensic firm so the investigation is privileged
- Notify your cyber insurer within the policy’s window
- If money moved, call your bank’s fraud line and file with the FBI the same day
- Track every clock: state notice laws, customer contracts and any regulator
- Wipe or restore systems before the evidence is captured
- Contact the attacker or pay anything without legal and insurer input
- Announce to customers before you know what was accessed
- Assume the vendor whose inbox was compromised will bear the loss without a claim
- Let marketing ‘security’ claims stand if they do not match what you found
From the firm’s writing.
New York SHIELD Act Attorney: Is Your Cybersecurity Reasonable?
What the State requires of any business holding New Yorkers’ data.
Read the articleBusiness Email Compromise: Critical First 72 Hours
What to do, in order, when a payment has been diverted.
Read the articleRansomware Payment: Legal Risks in the First 72 Hours
The legal questions before any payment is considered.
Read the articleFrequently asked.
It depends on where your users are and what data you hold. New York requires reasonable safeguards and breach notice for any business holding New Yorkers’ private information. California and a growing list of states have comprehensive privacy laws with thresholds based on volume and revenue. The EU and UK have their own. We map the laws to your actual user base.
New York’s SHIELD Act scales the duty to the size of the business and the sensitivity of the data. In practice it means administrative, technical and physical safeguards: access controls, multi-factor authentication, encryption, vendor oversight, training and a written plan. The program must match what you promise customers.
New York requires notice to affected residents within 30 days of discovery. Other states differ. Enterprise contracts often require notice to the customer within 24 to 72 hours. Public companies disclose material incidents within four business days of a materiality determination. The clocks run at once, which is why the plan comes first.
Sometimes, if you move within hours. We engage your bank, the receiving bank and the FBI immediately to attempt a freeze. After that, the question becomes whose system was compromised and what the contracts say about the loss. Our cybercrime practice handles these claims regularly.
Not without legal, forensic and insurer input first. Payment can carry sanctions risk, may not restore data and is often not covered without the insurer’s consent. The decision is a legal one as much as a technical one, and it must be documented.
Other areas of the practice.
Six services for technology companies, from ongoing counsel to the dispute. Back to the overview.
Building your privacy program, or responding to an incident now?
A confidential consultation with privacy and cybersecurity lawyers in Lower Manhattan. If it is happening now, call.