A CEO Blueprint: What to Do if Your Company Is Cyberattacked

On the other hand, the following factors may warrant asking law enforcement to conduct an investigation:

When you are already notifying the government – As noted above, your company may be obligated to notify non-law enforcement agencies, such as the U.S. Department of Health & Human Services in the event of a breach involving unsecured protected health information.  In such a situation – given the possibility that the notified agency will refer the matter to law enforcement – it may make sense to reach out to law enforcement in the first instance to frame the issues, select the witnesses for interviews, and gain an initial impression as a good faith partner interested in cooperation.

Ability to manage the situation – Being proactive and moving quickly in notifying law enforcement may help to influence the tone of the government’s investigation, foster a cooperative relationship between your company and the investigators, and, most importantly, maximize the chances that the perpetrator will be caught and convicted.

Mitigation of liability – Involving law enforcement early in the process may help the company to better position itself in dealing with any future regulatory actions stemming from the breach, as well as in responding to litigation from shareholders, consumers, and other entities.

Delayed public notification – Notifying law enforcement may enable the company to postpone a disclosure of the breach to the public and regulators while the criminal investigation runs its course.

Deterrent effect – By contacting law enforcement, your company may develop a reputation as being serious about data breaches and thus deter future intrusions. This is particularly true with respect to breaches of data that are considered trade secrets.

How should you notify law enforcement?
Which agency is appropriate? If your company decides to notify law enforcement, be sure to contact the appropriate agency. At the federal level, the Federal Bureau of Investigation (“FBI”), Homeland Security Investigations (“HSI”), and the Secret Service share primary responsibility for investigating cybercrimes, with significant overlap. The FBI is appropriate for most domestic cybercrime, including criminal hacking, theft of trade secrets, and identity theft. HSI investigates cross-border cybercrimes, including foreign-based hacks, while the Secret Service focuses on theft of payment card and other payment information. Finally, in the event of a smaller breach, it may be appropriate to reach out to state or local law enforcement agencies.

How do I make contact?
To contact any of these agencies, work with your counsel to file a report with the local field office, headquarters, or via an online repository (e.g., the iGuardian portal shares intrusion information with the FBI). Your counsel may have contacts with the relevant agencies – particularly the local field offices – that could facilitate and help manage the company’s initial interaction with law enforcement.