What a Business Should Do After Discovering a Security Breach That Might Lead to Criminal Investigation

A security breach is one of the most disorienting crises a business can face. In the span of hours, leadership teams go from routine operations to emergency meetings, forensic reviews, and urgent conversations with legal counsel. The situation becomes exponentially more serious when that breach carries signs of criminal activity - unauthorized access, ransomware deployment, data exfiltration, or financial fraud targeting your systems. At that point, the business is no longer simply dealing with an IT problem. It is potentially at the center of a criminal investigation, either as a victim cooperating with law enforcement, or in more complicated cases, as an entity under scrutiny itself.

Knowing what steps to take immediately - and just as importantly, what not to do - can mean the difference between a manageable incident and a catastrophic legal exposure. The decisions made in the first 24 to 72 hours after discovering a breach often shape the entire trajectory of any resulting investigation. This guide walks through the essential steps a business should take when a security breach may lead to criminal proceedings, and why having experienced legal counsel involved from the very beginning is not optional - it is critical.

Stop the Bleeding Without Destroying the Evidence

The first instinct when a breach is discovered is to shut everything down and wipe affected systems clean. While containing the damage is absolutely necessary, acting without guidance can inadvertently destroy digital evidence that law enforcement will need - and that your own attorneys will need to defend your interests. This tension between containment and preservation is one of the most delicate aspects of early breach response.

Your IT team or a retained cybersecurity incident response firm should isolate compromised systems from the broader network to prevent further unauthorized access or data exfiltration. This means segmenting affected servers and endpoints without wiping or reimaging them. Logs, memory captures, access records, and system snapshots should be preserved in a forensically sound manner. Chain of custody matters in criminal proceedings, and evidence that cannot be authenticated or that appears to have been tampered with loses its value entirely.

During this phase, avoid the temptation to have internal IT staff conduct a full remediation on their own. Bring in a qualified digital forensics firm that understands how to document findings in a way that will hold up under legal scrutiny. The work product they generate may eventually be reviewed by federal investigators, prosecutors, or defense attorneys, and it needs to reflect professional standards.

• Isolate affected systems without powering them down or wiping data
• Preserve system logs, access records, and network traffic data
• Document the discovery timeline with timestamps and names of personnel involved
• Retain a qualified digital forensics firm with experience in legally sensitive matters
• Avoid discussing breach details over potentially compromised communication channels

Engage Legal Counsel Before Communicating With Law Enforcement or Regulators

Many business owners assume that calling law enforcement immediately is the right and responsible thing to do after discovering a breach. In some cases, reporting is legally required. However, what you say, how you say it, and when you say it can have profound consequences for your organization. Before making any formal disclosures to law enforcement, regulatory agencies, or the public, your business needs an attorney who understands the intersection of cybercrime law and criminal defense.

This is where firms like Marwaha Law Group, PLLC provide a decisive advantage. With a background in both prosecution and criminal defense, attorneys at this level understand how federal agencies like the FBI and Secret Service build cybercrime cases, what investigators are looking for when they arrive, and how early statements by company representatives can be used later in ways that were never intended. Businesses that speak freely with agents without counsel present sometimes find themselves transitioning from cooperating witnesses to subjects of investigation.

Attorney-client privilege is a powerful protection, but it must be established and maintained properly. Internal communications about the breach, assessments of what went wrong, and discussions of potential liability should be conducted under the protection of legal counsel wherever possible. Once communications are sent outside that privileged relationship, they can potentially be subpoenaed.

• Retain criminal defense counsel with cybercrime experience before speaking to investigators
• Route internal breach communications through legal counsel to preserve privilege
• Do not make voluntary statements to federal agents without an attorney present
• Understand your reporting obligations under applicable state and federal law before filing reports
• Consult with counsel on timing and content of any regulatory notifications

Understand Your Notification Obligations and Legal Exposure

Businesses operating in the United States face a patchwork of breach notification laws at both the federal and state level. Depending on your industry, the type of data compromised, and the states where affected individuals reside, you may be legally required to notify customers, employees, regulators, and in some cases law enforcement within specific timeframes. Failure to comply with these notification obligations can itself give rise to regulatory penalties and, in some circumstances, criminal liability.

Healthcare organizations must comply with HIPAA breach notification requirements. Financial institutions have obligations under the Gramm-Leach-Bliley Act and more recent rules from the Federal Trade Commission. Companies subject to New York state law face the requirements of the SHIELD Act, which imposes notification duties and mandates reasonable data security practices. Publicly traded companies now face SEC disclosure rules requiring timely reporting of material cybersecurity incidents. Each of these frameworks has its own definitions, timelines, and scope of required disclosures.

Beyond notification, your business needs to assess its potential criminal exposure. If the breach involved insider activity - a disgruntled employee, a contractor with improper access, or an executive who misused system privileges - those individuals may face prosecution under the Computer Fraud and Abuse Act or state computer crime statutes. If your business is found to have had knowledge of ongoing unauthorized access and failed to act, or if there are questions about whether proper security standards were maintained, the organization itself could become a target of scrutiny. Understanding where you stand legally requires a candid assessment with experienced counsel as early as possible.

Cooperate Strategically With Law Enforcement While Protecting Your Rights

When federal investigators become involved in a cybercrime case - whether the business is a victim, a witness, or a subject - cooperation often serves the organization's long-term interests. Demonstrating good faith, preserving evidence, and being responsive to lawful requests can help establish credibility with prosecutors and may influence how the government views the organization's culpability or diligence. However, cooperation must be strategic, not unconditional.

Federal agents may arrive with search warrants authorizing the seizure of servers, workstations, mobile devices, and business records. Device seizures in cybercrime investigations can be enormously disruptive to operations, and the scope of what agents can take is often broader than business owners expect. Having legal counsel present during any search, or at minimum immediately available by phone, allows your team to understand the boundaries of the warrant, document what is taken, and raise any legitimate objections to overreach.

Employees who are interviewed by investigators should be advised of their rights and encouraged to speak with an attorney before providing statements. Even well-intentioned, truthful statements made under the stress of a criminal investigation can be mischaracterized or taken out of context. This is not about obstructing justice - it is about ensuring that the people within your organization are protected as the legal process unfolds.

Your attorneys can also help navigate grand jury subpoenas, which are commonly used in federal cybercrime investigations to compel the production of documents and testimony. Responding properly to a subpoena requires careful review to identify potentially privileged materials, assess the scope of the demand, and ensure that your response neither under-produces required materials nor waives protections you are entitled to assert.

• Have legal counsel present or immediately available during any law enforcement search
• Document all devices and materials seized with specificity
• Advise employees of their right to consult an attorney before speaking with investigators
• Review grand jury subpoenas with counsel before producing any documents
• Maintain a cooperative posture without making unnecessary voluntary disclosures
• Keep a detailed log of all interactions with law enforcement from the point of discovery forward

Build Your Defense and Recovery Strategy From Day One

Incident response and legal defense are not sequential processes - they must run in parallel from the moment the breach is discovered. Every decision made during the incident response phase has legal implications. Every piece of evidence collected, every vendor engaged, every communication sent internally or externally is potentially relevant to subsequent proceedings. Organizations that treat legal strategy as something to address only after the technical dust settles often find themselves at a significant disadvantage.

A comprehensive post-breach strategy includes not only criminal defense considerations but also civil liability exposure. Affected customers or business partners may bring claims arising from the breach. Regulators may open enforcement investigations separate from any criminal proceeding. Insurers will scrutinize your breach response to determine coverage. Each of these tracks requires attention, and the positions your organization takes in one arena can affect outcomes in another.

Working with attorneys who understand the full scope of cybercrime law - from federal charges under statutes like the Computer Fraud and Abuse Act and the Electronic Communications Privacy Act to state-level digital crime laws - gives your business the most complete picture of its exposure and options. Experienced counsel can also help reconstruct what happened in a way that is legally accurate and strategically sound, identifying third-party actors who may share responsibility, and documenting the security measures your organization had in place prior to the breach.

Ultimately, the businesses that navigate post-breach criminal investigations most effectively are those that treat the legal and technical dimensions of the crisis as inseparable, engage qualified professionals immediately, and make every decision with the full legal landscape in mind. Fall is a particularly active season for cybercrime activity, with threat actors targeting businesses during the busy retail and financial close period - making preparedness more important than ever.

If your business has discovered a breach that may involve criminal activity, or if you are facing scrutiny from federal or state investigators in connection with a cybercrime incident, the legal team at Marwaha Law Group, PLLC is prepared to help. With deep experience in cyber crime criminal defense, federal investigations, and digital evidence, Nipun Marwaha and his team provide the aggressive, sophisticated advocacy that complex digital allegations demand. Do not wait until charges are filed to get counsel involved. Contact Marwaha Law Group, PLLC today to start your free case review and put a proven defense strategy in motion from the very beginning.