After A Breach

Find a data breach lawyer

Draft: pending legal review.

A lawyer who handles data breaches can tell you which notification rules apply to you and when, and can help protect your position while the facts come in. Call one early, before you contact regulators or customers.

1. Start with your cyber insurance

If you have a cyber policy, read it or call its breach hotline first. Many policies set out which breach counsel and forensic firms the insurer approves and when you must give notice. Using someone outside that list, or waiting too long, can affect your coverage. Ask the insurer for a claim number and for their approved breach counsel. You can still talk to your own lawyer too.

2. Use a bar referral service

These are run by bar associations, not by us or by law firms that pay to be listed.

  • ABA: Find Legal Help

    The American Bar Association's starting point for finding legal help. The ABA says it does not make referrals itself.

  • ABA: Lawyer Referral Directory

    Find your state or local bar association's lawyer referral service, which can match you with a lawyer in your area.

3. Or look at firms that publicly advertise breach response

We have no affiliation or commercial relationship with any firm on this list. We receive no payment, referral fee, or other benefit from them, and they didn't ask to be listed. A listing is not an endorsement or a recommendation, and the list is not a ranking. It is in alphabetical order.

We selected these firms because each states on its own website that it handles data breach or incident response. We have not vetted their quality, fees, or availability and can't tell you whether one is right for you. Always check conflicts, experience, and fees yourself. Information was read from each firm's site on 2026-11-03 and may be out of date. We list no phone numbers because we couldn't verify them: use the contact details on the firm's own site.

  • BakerHostetler

    What the firm says: Says its Digital Assets and Data Management group advises on 'responses to data security incidents of all kinds'; publishes an annual Data Security Incident Response Report (2026 edition released Mar 26, 2026 per firm site search result).

    States on its site that it works with small and mid-size organizations.

  • Clark Hill

    What the firm says: Page lists a '24/7 Breach Hotline'; covers privacy regimes such as CCPA, GDPR, NYDFS, HIPAA.

  • Connell Foley

    What the firm says: Says it serves as breach response counsel and will assess federal, state and local obligations, draft consumer and attorney-general notices and liaise with federal law enforcement; 24/7 hotline.

    Note: Says it is an authorized NetDiligence Breach Coach firm and works with cyber insurance carriers. That is information from the firm's own site; ask about how it affects your matter.

  • Constangy

    What the firm says: Says its Cyber Team handles breach notification requirements, hotline management and provides 24/7 availability; offers an interactive state breach-law map.

    Note: Says its team is a preferred provider for more than 70 cyber insurance carriers. That is information from the firm's own site; ask about how it affects your matter.

  • Greenberg Traurig

    What the firm says: Says its team has helped clients prepare for, respond to and litigate data breaches, including phishing, ransomware and inadvertent disclosure; 24/7 Data Breach Hotline.

    States on its site that it works with small and mid-size organizations.

  • Hodgson Russ

    What the firm says: Press release (2025-07-28) says its Cybersecurity & Privacy Practice offers 24-hour incident response and breach notification and was named a NetDiligence Breach Coach firm.

    Note: Holds a NetDiligence Breach Coach designation. That is information from the firm's own site; ask about how it affects your matter.

  • Husch Blackwell

    What the firm says: Describes data privacy and cybersecurity practice including incident response, breach counseling and regulatory defense; breach response covers notification, insurance coverage, regulatory reporting and communications.

  • Lewis Brisbois

    What the firm says: Advertises a '24/7 Data Breach Response' rapid response service.

  • McDonald Hopkins

    What the firm says: Says it provides incident response legal services, develops a customized plan on notification, and helps with state, federal, international and industry breach-notice laws.

    Note: Describes itself as a NetDiligence Breach Coach firm. That is information from the firm's own site; ask about how it affects your matter.

  • Mullen Coughlin

    What the firm says: Site lists Breach Response described as '24/7 Crisis Management Services' with a 'Breach Hotline'.

  • Nelson Mullins

    What the firm says: Says it coaches clients through incidents, coordinates forensics, handles notifications to affected parties and regulators, and defends related investigations and class actions; says it is available around the clock.

    States on its site that it works with small and mid-size organizations.

  • Wilson Elser

    What the firm says: Describes cyber risk management, breach response including notification letters tailored to differing state requirements, and representation before state AGs, HHS OCR and FBI; lists 24/7 incident response hotlines but publishes no number.

    States on its site that it works with small and mid-size organizations.

    Note: Also acts as coverage and monitoring counsel for insurance carriers on cyber claims. That is information from the firm's own site; ask about how it affects your matter.

This list is not complete, and many excellent firms are not on it. Do you run a firm and want a correction? Tell us.

Questions to ask any lawyer

  • Have you handled breaches for organizations like ours (size, industry, the kind of data involved)?
  • Can you start now, and who will actually be working on it?
  • Should the forensic investigation be engaged through your firm, and why?
  • How do you charge, and what should we expect to spend in the first week?
  • Do you represent any of our vendors, our insurer, or anyone else who could conflict with us?
  • Which notification rules do you expect to apply to us, and what do you need from us to decide?

This page is general information, not legal advice, and finding a lawyer through it creates no attorney-client relationship. See the full disclaimer. Back to your plan.

More resources: all directories · Who to report to · Platform contacts · Choosing an incident-response firm · For affected individuals