CYFOR’s cyber response do’s and don’ts for in-house lawyers
CYFOR are a leading provider of specialised forensic services with dedicated divisions in digital/mobile forensics, eDiscovery, corporate forensic investigations and cyber security. CYFOR deal with over 500 incident response matters annually, working with both in-house and external law firms. We asked CYFOR to provide us with some practical do’s and don’ts to support in-house lawyers in the immediate aftermath of a cyber incident.
Monday, 9:47am: the immediate hours after a cyber incident
Monday, 9:47am. IT flags something odd: files are encrypting across the network. By 10:15am it's confirmed. Ransomware. Client data, staff records and financial systems are all in play, and the phone starts ringing.
What usually follows is predictable. IT starts pulling systems offline. The CEO wants to know exactly what happened, right now. Someone asks whether you have cyber insurance and nobody is sure. A suggestion to pay the ransom meets immediate disagreement. And someone is googling "IT help".
Every instinct is understandable. Almost all of them are wrong. In the middle sits the in-house lawyer, asked to make consequential decisions while the facts are still moving. Here is how to help your business through the immediate hours without making things worse.
Do
Call the insurer first
Your cyber policy will usually dictate which incident response and legal panel firms you must use. Going outside the panel risks a coverage dispute. One call can activate the whole response: forensics, breach counsel and crisis support.
Instruct forensics through lawyers
Engaging the digital forensics and incident response (DFIR) team through legal counsel gives the best chance of privilege attaching to their findings. Get this wrong, and the forensic report may be disclosable in later regulatory or litigation proceedings. It is a day-one decision with long-term consequences.
Issue a litigation hold
Evidence preservation routinely falls through the gap. DFIR focuses on remediation, legal on privilege, and nobody owns the hold. Preserve logs, emails, backups and access records, and agree with DFIR which systems can be rebuilt and which must be kept. You are often best placed to know where the data sits and what litigation lies ahead.
Start the clocks
UK GDPR gives 72 hours from awareness to notify the ICO of a reportable personal data breach. That sounds generous until you realise the first four hours went on not knowing and the next four on calling the wrong people. Add FCA/PRA expectations, SRA duties for law firms, and contractual clauses, many requiring notice within 24 to 72 hours and the time suddenly feels much shorter.
Control communications
Route all incident communications through legal. Keep internal updates factual and on a need-to-know basis, with a scheduled daily leadership briefing rather than ad hoc interruptions. Prepare a holding statement: say little, and say it once. Give key clients a single named contact and don't speculate about what data was affected. Write nothing you wouldn't want a judge to read.
Brief the board on exposure, not technology
Directors need obligations, liability and reputational risk, not malware strains. Keep contemporaneous, privileged notes of what was decided, by whom and why. Those records are your protection when regulators and claimants come asking.
Don't
Let anyone pull the plug
Powering down servers destroys volatile memory. The evidence investigators need to identify the attacker and scope the breach. Isolate rather than switch off, and let DFIR lead containment.
Investigate it yourself
The CEO's first request is often for legal to "find out what happened". Resist. You and your devices are inside the blast radius. Your job is to instruct and oversee, not to collect evidence.
Allow unilateral ransom decisions
Payment may breach sanctions law, doesn't guarantee decryption and marks you as a willing payer. It is a sanctions, insurance and board decision, with external counsel involved. Never confirm or deny payment publicly.
Use WhatsApp or personal devices
Keep incident matters off personal email and messaging apps. A stray message on an unsecured channel can undermine privilege. Using your personal phone may mean authorities demand it later to capture data.
Play crisis PR
The urge to reassure is natural, but every communication is effectively a legal document. A premature "no data was taken" is very hard to walk back.
Prepare before the phone rings
All of this is far easier with a tested incident response plan, a clear grasp of your policy and panel, a DFIR retainer and a privilege framework agreed with external counsel in advance. An annual tabletop exercise with legal, IT, comms and the board will find the gaps before an attacker does.
The question is no longer if, but when. Make sure that when Monday at 9:47am arrives, your business knows who calls whom.
If you would like to discuss anything in this article further, please contact: contact@cyforsecure.co.uk
In the IHL seat
We are pleased to introduce Josh Dolan, Legal Counsel at Giacom for our IHL x Pannone guest interview. Giacom is a UK based IT and communications. It offers a comprehensive range of cloud, IT, comms and software services and is the leading digital platform for technology resellers. Having started his career with Pannone Corporate, we enjoyed catching up with Josh on everything since his move in-house.
The SRA shines an ethics spotlight on in-house lawyers
Last year, we welcomed Lee Castleton OBE as a guest at our annual In-House Lawyers Conference. Lee spoke movingly about his legal battles with the Post Office and the ethical lessons he urges the legal profession to take away from his own experiences.
The Law Society defends legal professional privilege for in-house lawyers
The Law Society’s recent move to intervene in the case of Broadcom Inc and VMWare International Unlimited Co. v the European Commission defends legal professional privilege (LPP) for in-house lawyers.
CYFOR’s cyber response do’s and don’ts for in-house lawyers
CYFOR are a leading provider of specialised forensic services with dedicated divisions in digital/mobile forensics, eDiscovery, corporate forensic investigations and cyber security.
Our Pannone x IHL is designed to bring you the latest news and legal developments relevant to in-house lawyers. If there are any areas you would like more information on or if you have any questions or feedback, please do not hesitate to let us know via our feedback form or get in touch with any member of our team.
Copyright in this publication is owned by Pannone Corporate LLP and all rights in such copyright are reserved. Pannone Corporate LLP is a limited liability partnership registered in England and Wales with number OC388393. Authorised and Regulated by the Solicitors Regulation Authority. A list of members is available for inspection at the registered office, 378-380 Deansgate, Manchester M3 4LY. We use the terms “partner” to refer to a member of the LLP.