If you think your firm has been hacked, call 310-213-1000 now and keep reading while you dial. The first hour decides how bad a security incident gets, and most of what matters in that hour is what you don't do.
Call 310-213-1000 →
Unplug the network cable or turn off Wi-Fi on any computer that looks compromised. Leave it powered on. Shutting it down can destroy the evidence that tells us what happened.
310-213-1000, call or text. Tell us what you saw and when. We'll take it from there, including the decision about what to disconnect next and who else to call.
If an email account is involved, don't send from it, don't reset the password from the same device, and don't reply to anything suspicious. We'll lock it down properly in minutes.
Don't delete the suspicious emails, run cleanup tools, or wipe a machine. Your insurer and counsel will want the trail intact, and so will we.
Tell the people who need to know, by phone or text rather than email. If an attacker is reading your mail, a firm-wide announcement tells them you've noticed.
Who noticed what, at what time, on which device. Screenshots help. A simple timeline written in the first hour is worth days of reconstruction later.
For an active incident, call or text. You reach Nick Curran or a nicwerks® engineer, not a queue. Don't email from an account you think is compromised; if you need to write, text the number above or email help@nicwerks.com from a personal account or your phone.
For anything that can wait until business hours (Monday to Friday, 8 a.m. to 8 p.m. Pacific), open a support request and a real, local engineer picks it up.
Most cyber policies require you to notify the carrier before engaging anyone, and many have a panel of approved forensics and breach-counsel firms. We help you make that call in the first hour, then work alongside the carrier's team: containing the incident, supplying logs and technical evidence, and documenting the response in the form adjusters expect. If you don't yet have a policy, we'll tell you plainly what that means for the recovery.
When counsel directs the investigation, our findings flow through them, which helps protect privilege. We translate the technical picture into plain English for attorneys, take direction on notification to clients and regulators, and handle the mechanics of containment and recovery so counsel can focus on the legal exposure. For law firms, that includes the ethics and client-confidentiality questions your bar expects you to have thought about.
Don't decide that alone or quickly. Payment is a decision for your leadership with your insurer and counsel involved, and some payments are legally restricted. Our job is to tell you what we can recover without paying, and how fast.
It depends on what was accessed and the laws that apply, including California's breach notification law and, for law firms, your ethical duties. Counsel makes that call. We give them the facts they need to make it well.
Yes. Call the same number. For firms we don't yet support, incident work is billed hourly during the response, and we coordinate with your carrier on what the policy covers. Many of our longest client relationships started on a bad day.
After the incident is contained, we walk your leadership through what happened and what would have stopped it. For most firms that means multi-factor authentication done right, endpoint detection with a 24/7 SOC, tested backups, and someone accountable for security. That last part is what our vCISO service is for.
A free assessment tells you whether your backups, MFA, and email security would hold up, and who you'd call. In an active incident, skip the booking and call 310-213-1000.
