Breach coach
A lawyer appointed as soon as a cyber incident is reported to coordinate the response, notifications and vendors, notably to bring the technical investigation under legal privilege.
A breach coach is a lawyer, usually from the insurer's panel, who takes legal charge of the response to a cyber incident from the first hours. The coach assesses the incident against notification obligations, retains the forensic firm, public relations specialists and call centers, coordinates exchanges with authorities and law enforcement, and prepares communications to affected people. The role, born in the United States, follows a precise litigation logic: by having the lawyer commission the technical investigation, so as to advise the client in anticipation of litigation, one seeks to bring it under legal privilege and prevent the report from becoming evidence in a class action. That protection is fragile, and courts set it aside when the investigation would have been conducted anyway for operational reasons. In Europe the role exists under other names and with a different scope of privilege, but the coordination function remains. For the insurer, the coach serves first to contain claim costs, since mistakes in the first hours are the most expensive.
In May 2020, a federal court in Virginia ordered Capital One to produce the forensic report on its 2019 data breach, affecting about 106 million people, even though it had been commissioned by its lawyers: the vendor was already under contract before the incident and the report had been widely shared internally, making it an operational document rather than defense work.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.