1. What the Notice Reveals about Your Records
A notification may identify information categories without confirming whether someone copied particular documents. Separate confirmed findings from questions investigators have not resolved.
Verify the notice through the firm’s established contact channel before submitting identification or opening unfamiliar links.
Confirmed Access and Possible Exposure
Record the incident, discovery, and notification dates separately if provided. “No evidence of misuse” does not necessarily mean nobody accessed your records. Ask whether investigators confirmed access, copying, or public disclosure and which findings concern your information.
A notice about Social Security numbers may leave legal documents unaddressed. Ask whether affected materials included legal advice, settlement discussions, financial disclosures, medical records, or evidence needed for your matter. Request an update plan if the investigation remains incomplete.
2. Statutory Notice and Client Communication Duties
Statutory notification addresses defined private information. Professional communication duties can also address compromised client confidences or interruptions to representation.
Statutory Requirements
General Business Law § 899-aa generally requires notice to affected New York residents when covered computerized private information was, or is reasonably believed to have been, accessed or acquired without authorization.
Notice must follow without unreasonable delay and generally within 30 days after discovery. A law enforcement determination that notice would impede a criminal investigation can permit delay. A limited exception covers certain inadvertent disclosures by authorized persons, subject to documented findings.
Covered information includes specified identifiers, account credentials, and qualifying medical or health insurance information. Encryption and exposure of encryption keys can affect coverage. Sensitive legal advice does not automatically fall within the statutory definition.
The notice must describe affected information categories and provide contact details and relevant agency resources. It does not automatically entitle recipients to the complete forensic report.
Current Clients and Former Clients
Rule 1.4 requires attorneys to communicate material developments to current clients. New York City Bar Formal Opinion 2024-3 explains its application to cybersecurity incidents.
Compromised confidences from a current matter can require prompt disclosure. An incident that materially impairs representation can also require notice without confirmed information exposure.
Former clients may qualify for statutory notice, although Rule 1.4 generally does not impose the same communication duties toward them. Confidentiality obligations continue after representation ends.
These privacy and data protection obligations require separate analysis. The statutory deadline is not a general waiting period for ethical disclosure.
3. Requesting Details and Assessing Harm
A written request preserves your questions and the firm’s response. Focus on your records, available copies, and any disruption to ongoing work.
| Information involved | What to ask |
|---|---|
| Identity or account details | Which identifiers were affected and what services are offered |
| Legal communications | Whether advice or negotiation positions were exposed |
| Medical or financial records | Which record categories investigators identified |
| Unavailable files | Whether usable copies exist and upcoming work can proceed |
For an active matter, request confirmation of filing deadlines and any effect on evidence preparation. A general statement that the firm remains operational may not answer whether your documents are available.
The firm may have grounds to withhold other clients’ information or protected investigative material. Request an explanation about your matter separately from access to its investigation.
Protective Steps and Evidence
Change affected and reused passwords, enable multifactor authentication, and report suspicious transactions to financial institutions. Consider a free credit freeze with each nationwide credit reporting agency.
Credit monitoring does not resolve leaked legal advice or missing evidence. Discuss those concerns separately with the attorney handling your matter.
Preserve notices, correspondence, account alerts, receipts, and a dated activity log. Document actual expenses and their connection to the incident rather than assuming unrelated fraud resulted from this breach.
4. Complaints and Possible Claim
The appropriate procedure depends on the problem. Clients can report privacy or notification concerns to the New York Attorney General. Suspected professional misconduct may warrant an Attorney Grievance Committee complaint. Disciplinary review does not replace a damages lawsuit.
GBL § 899-bb does not create a private right of action. Other claims require a separate legal basis, supporting facts, and applicable deadlines.
A data breach class action requires analysis of injuries and the requirements for proceeding collectively. Similar notification letters do not establish entitlement to payment.
A legal malpractice claim generally requires attorney negligence that caused actual, ascertainable damages. A breach or ethical violation alone does not establish those elements.
5. Frequently Asked Questions
Protective-service offers and portal access can raise additional questions after notification.
Does Credit Monitoring Enrollment Release My Claims
Enrollment alone does not establish a release. Read the terms and distinguish the service offer from a separate settlement or release.
Should I Delete Documents from the Client Portal
Deletion may remove useful evidence without removing stolen copies. Preserve relevant records securely and ask about retention, portal security, and available copies before deleting materials.
6. Independent Advice about Ongoing Representation
Independent advice becomes relevant when you are considering a claim against the firm, reviewing a release, or questioning continued representation.
Bring the notice, engagement agreement, written responses, upcoming deadlines, and documented losses. An independent attorney can assess claims and conflicts alongside the underlying matter. Changing attorneys also requires attention to file transfer and existing court deadlines.
12 Oct, 2026
