Client feedback, leading legal directory
They were on the phone within minutes and calm throughout the worst week of our year.
Client feedback, leading legal directory
Practical advice on notification in dozens of jurisdictions, all in the same conversation.
Client feedback, leading legal directory
They managed the forensic work, the regulators and the board in parallel.
Client feedback, leading legal directory
A team that had clearly done this many times before.
Overview
Corvane Ryle's Data Breach Response team helps companies manage cyber incidents from the first alert through regulatory engagement and litigation. We are available around the clock, and our lawyers have advised on ransomware attacks, business email compromise, theft of customer data, insider incidents and compromises of vendors and cloud providers.
The first hours matter. We engage forensic firms under privilege, advise on containment and communications, decide with the client whether and how to engage law enforcement, and begin the analysis of who must be notified. That analysis is complex. The 50 US states each have breach notification statutes, the SEC requires public companies to disclose material cybersecurity incidents on Form 8-K, sector rules apply to financial services and healthcare, and the GDPR requires notification to supervisory authorities within 72 hours where there is a risk to individuals.
After notification, we manage engagement with regulators, including state attorneys general, the FTC, the SEC, the Information Commissioner's Office and EU data protection authorities, and we defend the class actions that often follow within days. We help clients preserve privilege in the investigation report, respond to demands for information and negotiate resolutions where they are needed.
Preparation reduces cost. We draft and test incident response plans, run tabletop exercises for boards and executive teams, and review vendor contracts for security and notification terms. For retailers that process payment cards and loyalty data, we also advise on PCI DSS and on lessons from recent retail incidents.
Tomás Ellery-Vance in Washington, D.C. leads the team with Helena Strand in London, supported by Privacy & Cyber lawyers in New York, San Francisco, Brussels and Frankfurt.
Key lawyers
Our breach response lawyers are on call in the United States and Europe.
- Tomás Ellery-Vance, Partner, Washington, D.C.
- Helena Strand, Associate, London
Areas of focus
Representative experience
- Led the response to a ransomware attack on a NYSE-listed specialty retailer.
- Managed notification across 38 jurisdictions after theft of customer data from a cloud provider.
- Defended a consumer goods company in a putative class action following a payment card incident.
- Represented a healthcare company before state regulators after a breach affecting several million individuals.
- Advised a technology company on SEC disclosure of a material cybersecurity incident.
- Coordinated a joint investigation response to the ICO and EU authorities for a logistics group.
- Ran a tabletop exercise for the board of a fintech company.