A law firm data breach rarely announces itself with a ransom note. More often a client calls to ask why the firm changed its wiring instructions, or a paralegal notices replies vanishing from her inbox, or the document management system suddenly will not open. What the firm does in the next 72 hours shapes the legal exposure, the insurance claim, and whether clients stay. This guide walks California firms through the first three days from an IT provider's point of view: containment, who to call, your ethics duties, the state notification law, and client communication. It is not legal advice. Retain experienced breach counsel as early as possible and follow their direction.
Start by recording when you found out, because California's clock starts there
Write down who noticed the problem, what they saw, and the date and time. That moment matters. Under SB 446, which took effect January 1, 2026, a business that owns or licenses computerized personal information of California residents must notify affected residents within 30 calendar days of discovering or being notified of a breach, according to a Pillsbury summary of the amendment. Delays are allowed when law enforcement asks for one, or when needed to determine the scope of the breach and restore the system's integrity. If more than 500 Californians must be notified, a sample notice goes to the Attorney General within 15 days of notifying them. The first 72 hours use up a tenth of that 30 day window.
Hours zero to four: contain the damage without destroying evidence
The instinct is to wipe and rebuild. Resist it. Disconnect affected computers from the network rather than powering them off or reimaging them, unless your forensic firm says otherwise, because memory, logs, and file timestamps are evidence. Disable compromised accounts, reset their passwords, and revoke active Microsoft 365 sessions so stolen sign in tokens stop working. If attackers created inbox forwarding rules or registered their own MFA device, document those details with screenshots before removing them.
Export audit and sign in logs now. Cloud services keep these records for limited periods, and an investigation that starts two weeks late can find the trail already gone. Confirm that your backups are intact and disconnected from the network, since ransomware groups go after backups first. Our guide to ransomware incident response covers the first 24 hours in more technical detail.
Finally, assume the firm's email is being watched. Coordinate the response by phone or through accounts the attackers could not have reached.
Who to call first: your insurer, breach counsel, and a forensic firm
Call your cyber insurer's claims line within the first hours. Many policies require prompt notice, and many require you to use vendors from the insurer's panel or get consent before spending money on lawyers and investigators. Hiring an unapproved firm on day one can complicate reimbursement. Your policy documents name the hotline, and our cyber insurance coverage guide explains what these policies typically pay for. Your professional liability carrier may also expect notice of a potential claim, so ask counsel.
Breach counsel usually retains the forensic investigators, so the investigation supports legal advice and has the best chance of staying privileged. Privilege is not guaranteed. In 2020, a federal court in the Capital One breach litigation ordered the company to produce its forensic firm's report, finding the work would have been done for business purposes regardless. Keep findings within the legal team.
The forensic firm determines how the attackers got in, how long they were present, and what they touched or took. Your IT provider supports that work by handing over administrator access, network diagrams, and logs, and by carrying out containment steps the investigators request. If the incident involves a misdirected wire, call the bank immediately and file a report with the FBI's Internet Crime Complaint Center at ic3.gov, because speed improves the odds of freezing funds.
Your ethics duties under ABA Formal Opinion 483 and the State Bar of California's breach opinion
The American Bar Association's Formal Opinion 483, issued October 17, 2018, applies Model Rules 1.1, 1.4, 1.6, 5.1, and 5.3 to data breaches. It says lawyers must make reasonable efforts to monitor for breaches, act reasonably promptly to stop a breach and mitigate the damage, make reasonable efforts to determine what happened and what client information was affected, and notify current clients when material client information was or is reasonably suspected to have been accessed or taken. The opinion does not find a Model Rules duty to notify former clients, while noting that other law may require it. Notice should give clients enough information to make informed decisions about the representation. Our summary of ABA cybersecurity guidelines for law firms places this opinion alongside the ABA's other technology guidance.
California lawyers answer to the California Rules of Professional Conduct and Business and Professions Code section 6068(e)(1), which requires attorneys to maintain inviolate the confidence and preserve the secrets of their clients. The State Bar's 2020 formal ethics opinion on data breaches, issued by its Committee on Professional Responsibility and Conduct, addresses the issue directly. It says that after a breach a lawyer must conduct a reasonable inquiry into its extent and consequences and must notify any client whose interests have a reasonable possibility of being negatively affected. It also recognizes that not every lost device or unauthorized access is a breach. Both opinions are advisory, but they describe what disciplinary authorities and courts will expect.
Check client contracts as well. Corporate clients' outside counsel guidelines can set their own notice deadlines and require specific details. If systems are down, counsel may also need to address court deadlines in active matters.
California's breach notification law, in plain terms
Civil Code section 1798.82 covers computerized personal information such as a name combined with a Social Security number, driver's license or state ID number, financial account number with its access code, medical or health insurance information, and online account credentials. Data that was encrypted is generally outside the notice requirement unless the key was also compromised. The statute provides a model notice titled Notice of Data Breach with five headings: What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information. Where a breach involves Social Security, driver's license, or California ID numbers and the firm was the source, the statute addresses offering identity theft prevention and mitigation services for at least 12 months at no cost, and counsel will advise on how that applies.
Law firm data rarely stops at the state line. Clients and opposing parties in other states trigger those states' notification laws. A firm holding health records for healthcare clients may be a HIPAA business associate, with its own duty to notify the covered entity no later than 60 days after discovery. Breach counsel maps all of these together.
Talking to clients: what to say, and what to hold back
Choose one spokesperson and route every client call to that person or to counsel. Train the receptionist on a short, accurate holding statement: the firm is investigating a security incident, it has engaged outside specialists, and it will contact affected clients directly with specifics. Do not speculate about who did it, and do not say "no client data was accessed" until forensics supports that statement. A reassurance that later proves false does more damage than the breach.
Give clients one practical warning right away if email was involved. Attackers who control a firm mailbox often send fake invoices and changed payment instructions to clients. Tell clients to confirm any payment request by calling a known number. Our guide to business email compromise explains how these schemes work.
Hours 24 to 72: scope the breach, restore safely, and plan the next 27 days
By the second and third days, the forensic firm should have preliminary findings on the entry point and the systems involved. Restore from clean backups only after investigators confirm the attackers are out, then reset every credential, enforce multifactor authentication everywhere, and close the hole they used. Build the list of affected clients matter by matter using document management and file access logs, since notification decisions depend on what each client actually lost. Keep a running record of every decision, who made it, and why. Regulators, insurers, and clients will ask.
Once the immediate crisis passes, write down what worked and what did not, and turn it into a tested incident response plan. ABA Formal Opinion 483 itself encourages lawyers to have one.
How GlobeVM helps law firms before and after a breach
GlobeVM has supported businesses for 30 years and looks after more than 75 organizations across Southern California. Firewall management, endpoint protection, email filtering, and multifactor authentication are standard in every plan, and 24/7 monitoring watches for the suspicious sign ins and mailbox rules that often come first. In an incident, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi, ready to work with your breach counsel and forensic firm.
See how we support law firms, or book a free IT assessment to find the gaps before an attacker does. You can also call (818) 405-9930.
Law firm data breach questions we hear from partners
How long does a California law firm have to notify clients after a data breach?
Under Civil Code section 1798.82 as amended by SB 446, affected California residents must be notified within 30 calendar days of discovery, subject to law enforcement and scoping delays. Ethics opinions separately call for reasonably prompt notice to affected clients. Counsel should set the exact timeline.
Does a law firm have to notify former clients?
ABA Formal Opinion 483 does not find a Model Rules duty to do so, but state breach laws apply based on whose personal information was involved, not whether the client relationship is current. The State Bar of California's 2020 breach opinion frames the duty around clients whose interests could reasonably be harmed.
Should we call the IT provider or the insurer first?
Both, within the first hour. Your IT provider starts containment and evidence preservation, and your insurer tells you which counsel and forensic vendors the policy covers.
Is a ransomware attack automatically a data breach?
Not automatically. It depends on whether personal or client information was accessed or taken. Many ransomware groups steal data before encrypting it, so forensic evidence, not assumptions, should drive that decision.
Will our forensic report be privileged?
Possibly, but not reliably. Having breach counsel retain the forensic firm for the purpose of giving legal advice helps, yet courts have ordered reports produced when the work looked like ordinary business activity. Limit distribution and follow counsel's guidance.