Breach data review after an incident
Review the data
Veil begins work once forensics has identified the data. We work with counsel to determine what type of information we are looking for and what can be excluded. We review the data and identify records that contain sensitive information, such as PII and PHI, and record the impacted individual.
Build the list
Records associated with the same individual are combined into a single entry, with the exposed information documented and linked to its source file. Although an individual may appear across multiple documents, they are counted only once in the final population.
Deliver the list
We work with counsel to put the notification list in the format the chosen notification vendor requires. Counsel decides who is notified and sends the notices. If the client needs another copy of the data for a legal hold, we provide it.
Capabilities
What Veil brings to a breach review
Large datasets
Mailboxes, file shares, and exported archives in the volumes a breach produces. The review is staffed to the size of the dataset.
Advanced technology
Software finds the likely matches across complex data quickly, so reviewers spend their time confirming findings instead of searching for them. To validate what the technology found, the findings are then reviewed and confirmed by a person.
Review protocol set with counsel
Scope and exclusions are agreed with counsel before the review starts. Any anomalies are reviewed with counsel for their determination, and the review protocol is updated so reviewers apply it consistently.
U.S.-based review and hosting
Our reviewers are located in the United States and your data is hosted here. It is not sent to overseas teams working under less restrictive privacy and confidentiality rules.
Faster delivery
Reviews are staffed to meet the notification deadline. Our projects regularly finish well ahead of the time other providers quote for the same work.
Lower price, U.S.-based review
Pricing is simple and locked in. You get a ballpark quote from the facts provided, then the price is locked once Veil has analyzed the full dataset, with no mid-project uplifts. That price has often come in below overseas quotes.
Deliverables
What you receive
An accurate notification list
Each person is entered once, with the information counsel has asked for and a link to the document it was found in. Notifying people who were not at risk wastes postage, call-center time, and goodwill. Missing someone who was at risk costs more. Entries on the list are confirmed by a reviewer and link back to their source files.
Formatting for Notifications
Notification vendors each want the list a certain way. We work with counsel to deliver it in the format the chosen vendor requires, so it can go straight to mailing without rework.
Data Returns
The data stays available for the life of the matter and is deleted after the final notification list has been delivered. If the client needs another copy for a legal hold or a later proceeding, we provide it before then.
When breach review is needed
What drives the matter
Breach counsel and carriers reach out when:
Who reviews the data
Veil is a veteran-owned cybersecurity and automation firm based in Austin, Texas.
Founder experience in military, federal, and regulated-sector security.
Veteran-owned. U.S.-based review team.
Response from an expert, typically within one business day.
The core team has worked directly with breach coaches and incident response counsel, and the review is built for law firms and insurance carriers. Counsel and the claims professional deal directly with the person running the review. References are available on request.
How the review starts
Whether forensics has just identified the data that was taken, partners are asking who was affected, or claims have started to come in, tell us what forensics found and what counsel needs. An experienced professional will normally respond within one business day to scope the review and put the price in writing.
Request a Free ConsultationFrequently asked questions
What is breach data review?+
A review of the data forensics identified to find the records that contain sensitive information, such as PII and PHI, and the people affected. It is also called data mining.
When does the review start?+
Once the incident is contained, forensics has identified the data, and the review protocol has been set with counsel. Scoping can start while forensics is still finishing.
Who does Veil work with?+
Insurance carriers, claims professionals, breach coaches, cyber attorneys, incident response counsel, and the organizations they represent.
Is the review done in the United States?+
Yes. Our reviewers are located in the United States and your data is hosted here. It is not sent to overseas teams working under less restrictive privacy and confidentiality rules.
Does Veil decide who has to be notified, or send the notices?+
No. Veil is not a law firm and does not give legal advice. Counsel decides whether notice is required and sends the notices. Veil provides the reviewed list they work from.
How does Veil keep the list accurate?+
The review protocol, including scope and exclusions, is set with counsel before the review starts. Findings are confirmed by a reviewer, anomalies are reviewed with counsel for their determination, and the review protocol is updated so reviewers apply it consistently.
What format is the list delivered in?+
Whatever format the chosen notification vendor requires. We work with counsel to set that up so the list can go straight to mailing.
Can we get our data back?+
Yes. The data stays available for the life of the matter and is deleted after the final notification list has been delivered. If the client needs another copy for a legal hold or a later proceeding, we provide it before then.
Can Veil work with the forensic firm already on the incident?+
Yes. Veil takes the data in the form the forensic firm delivers it and confirms what was received, so the two teams do not overlap.
How is the engagement priced?+
Pricing is simple and locked in. You get a ballpark quote from the facts provided, then the price is locked once Veil has analyzed the full dataset, with no mid-project uplifts. That price has often come in below overseas quotes for the same work.