Data breach readiness for small PI firms

Most small investigation firms will never have a dramatic, headline-making breach. But the ordinary versions happen all the time: a laptop stolen from a car, an email account taken over by a phishing link, a report sent to the wrong address, a cloud folder shared with “anyone with the link,” ransomware on the office computer.

For a PI, any of these can expose exactly the information that makes your files sensitive: subjects’ addresses, clients’ reasons for hiring you, surveillance footage, attorney work product. How you respond in the first hours and days decides how much harm follows, both to the people in your files and to your business.

This guide gives you a one-page plan to prepare now, and a sequence to follow if something goes wrong.

General information, not legal advice. Breach-notification duties are set by state law and vary. If you have a breach involving personal information, speak to an attorney promptly.

Why PI firms need a plan

You hold high-risk data. Home addresses of people who may not want to be found, photographs, financial and background information, and details of domestic, insurance and criminal matters.

You probably have notification duties. According to the National Conference of State Legislatures, every state (along with the District of Columbia and several US territories) has a law requiring notification of certain security breaches involving personal information. The definitions, deadlines and who must be notified differ from state to state, and the laws that apply usually depend on where the affected people live, not where you are.

Your clients have their own obligations. Attorneys, for example, have their own duties to their clients after a breach. If a breach of your systems exposes an attorney’s case material, they’ll need to know quickly so they can meet those duties.

Small firms are targets too. Attackers use automated phishing and password-guessing that don’t care how big you are, and small firms are less likely to have someone watching.

Before: the one-page plan

Write this down now, and keep a copy somewhere you can reach if your computer and email aren’t available (printed, or in your password manager).

1. Your data map. Where case data lives: devices, email, cloud storage, case software, backups, subcontractors. (See data security for private investigators.)
2. Your contacts.
   • An attorney who handles data-breach matters (find one before you need one)
   • Your professional-liability or cyber insurer’s claims line, and your policy number
   • An IT or security person you can call, even on an hourly basis
   • Your phone carrier, bank and email provider’s support routes
3. Your first-hour steps (below), printed.
4. Your clients’ contact details, so you can reach them without your email.
5. What your insurance covers. Many small-business and professional-liability policies exclude cyber incidents or cap them low. Find out now; a standalone cyber policy may be worth pricing.
6. Tested backups. Restore a file from backup every quarter. Ransomware recovery depends entirely on backups the attacker couldn’t reach.

Prevention reduces how often you’ll need the plan: password manager, two-factor authentication, full-disk encryption, updates, and secure file delivery. See password managers and 2FA for investigators.

During: the first hour

The FTC’s guide to data breach response is written for businesses of all sizes, and its first priority is to secure your operations and stop further loss, while preserving evidence of what happened. For a small PI firm that means:

If an account is compromised (email, cloud, case software):

1. Change the password from a device you trust and sign out all other sessions.
2. Check and remove any forwarding rules, filters, connected apps or recovery addresses the attacker may have added. Email forwarding rules are a favorite way to keep reading your mail after you change the password.
3. Turn on (or reset) two-factor authentication.
4. Check what was accessed or sent. Many services keep sign-in and activity logs.
5. Warn clients if the attacker may send messages from your account, especially payment-change requests.

If a device is lost or stolen:

1. Use the device’s remote lock and wipe features.
2. Sign the device out of your accounts and change passwords saved on it.
3. Note whether it was encrypted and powered off. Encryption can make a significant difference to whether a notification duty applies, which your attorney can advise on.
4. Report theft to the police and keep the report number.

If you suspect ransomware:

1. Disconnect the affected computer from the network (unplug the cable, turn off Wi-Fi). Don’t turn it off if you can avoid it; it may hold evidence.
2. Disconnect backup drives.
3. Contact your IT help, insurer and attorney before deciding anything else. CISA’s #StopRansomware guide has a detailed checklist.

If something was sent to the wrong person:

1. Ask the recipient to delete it and confirm in writing.
2. Revoke any link access.
3. Record what was sent, when and to whom.

In every case: don’t wipe or rebuild systems before you’ve captured what happened (screenshots, logs, the suspicious emails). You’ll need it to work out what was exposed, and your insurer and attorney may need it too. Start a written timeline of what you found and what you did, with times.

After: the first days

1. Work out what was exposed. Which cases, which people, what kinds of information. This determines who you must notify. Be careful and honest: it’s better to find out now than to have to send a second notice later.

2. Get legal advice on notification. State laws define which information triggers notice (often names combined with things like Social Security, driver’s license or financial account numbers, sometimes login credentials and more), who must be told, how, and how fast. Your attorney will work through which laws apply.

3. Notify your clients. Whatever the statutes require for individuals, contractual and professional relationships mean your clients should hear from you quickly and directly. Attorney clients in particular need to know promptly so they can meet their own obligations. Tell them what happened, what information was involved, what you’ve done, and what you’re doing next. Stick to facts; don’t speculate.

4. Notify others as required or advised. Depending on the incident: affected individuals, state regulators or attorneys general, your licensing authority, law enforcement, your insurer. Cybercrime can be reported to the FBI’s Internet Crime Complaint Center (IC3).

5. Fix the cause. The FTC guide stresses fixing vulnerabilities, including with your service providers. Reset credentials, patch systems, close sharing links, tighten access, and replace any process that failed (for example, how you verify payment-change requests).

6. Write it up. A short, factual incident record: what happened, what was exposed, who was notified and when, what you changed. Keep it with your business records.

Reducing the damage in advance

Some choices made now shrink what any future breach can expose:

• Keep less. Delete closed-case data on a schedule. See case file retention for private investigators.
• Encrypt devices. A stolen encrypted laptop is a much smaller problem than an unencrypted one.
• Don’t store case files in email. Deliver through a secure channel so inboxes don’t accumulate years of reports. See how to share files with clients securely.
• Choose vendors that hold less. If your case software’s vendor can’t read your data, a breach at the vendor exposes much less. See zero-knowledge encryption, explained.

Spotted an error? Tell us by email and we'll correct it.