Photo: Fotolia

Much like your friendly-neighborhood Walmart, responding to data security breaches is now a 24-hour business. A new app from Lewis Brisbois Bisgaard & Smith's data privacy and cybersecurity division will give users around-the-clock access to the firm's Data Breach Rapid Response team. This means that when the worst happens at 2 a.m., victims will able to take immediate action that doesn't involve trying to calm their nerves in front of a “Happy Days” rerun.

Since hackers and other bad actors have demonstrated a reluctance to adhere to traditional business hours, the late nights, early mornings and everything in-between approach just might have to become the new model for firms looking to stand out in a marketplace where “response time” is a crucial variable.

“I think in this digital environment, let's just say that victims need responses immediately. So whatever infrastructure you want to create, if you want to be successful, you need to be responsive,” Sean Hoar, chair of Lewis Brisbois' data breach and cybersecurity department, said.

Speaking of infrastructure, the Lewis Brisbois model is built on a team of 20 attorneys spread across each time zone. Working that way has its disadvantages—Hoar can't just poke his head out the door and get a status update from a co-worker—but there are advantages too, some more obvious than others.

Even though the firm's home base is Los Angeles, they have potential clients located in different regions across the country who want someone nearby on the ground. It can also help to have attorneys who speak the same dialect as the people they're advising.

“I know that may sound silly but it's true. When somebody is in crisis they want somebody who they appear to share some commonality with, whatever that might be, and sometimes language is a starter,” Hoar said.

Team members rotate through a duty roster broken down into seven-day shifts consisting of a primary and secondary attorney. The cycle commences at 12 a.m. Monday and concludes at 11:59 p.m. the following Sunday, and what happens in the middle is often difficult to predict.

Should a call roll in during the pre-dawn hours, it is immediately screened through a conflict checker to make sure that there's not a pre-existing interest at odds with moving forward. The lawyers on duty could find themselves on the phone with a client minutes later, with the rest of the evening's itinerary eaten up by conversations with in-house compliance managers and a deployment of forensics experts, navigating consumer reporting regulations and mapping the scope of the breach.

The hours are long and the decisions can be stressful. Hoar acknowledges it's not for everybody.

“The evaluation of who's going to be on the team involves that too. I'm looking not just for people who are really smart with the strength to have a tech background if at all possible and a litigation background so you can assess third-party liability, but you also need what I call an 'attitude of contribution,'” Hoar said.

Fortunately, there's also the team itself to fall back upon. Throughout the breach response process, a matter tracking application helps organize budgets, time frames and task assignments. Even if the initial call is fielded at 3 a.m. by an attorney on-call in New York City, by daybreak the onus could be transferred to teammates working in closer proximity to a client's physical location.

“I want to make sure that we've always got enough depth to handle anything that comes through the door, regardless of the type of day,” Hoar said.