WorkfloweDiscovery & Litigation Support

Data Breach Document Review

Data breach review that turns a stolen data set into one list of people, each linked to the files that expose them and to the notice rules of the state they live in.

Watch it work Book a walkthrough

Follow the stolen files to the signed letters ↓

Watch with transcript →

The problem

A data breach review copied row by row ends after the shortest deadline

After a leak, contract reviewers open the stolen files one at a time and copy each name and SSN into a spreadsheet. The same person turns up on a payroll sheet, a claims export and a billing email, under a maiden name or an old address, and the matching waits until the end.

Counsel then rebuilds the law state by state and element by element. A bank account number counts in one state only with its access code; health information counts in some states and not in others. A merge error costs a letter both ways: one person mailed twice, or one person who hears nothing at all.

Built forBreach coachesPrivacy attorneysReview managerseDiscovery teams

The Problem Today

After a breach, someone must find each person in the stolen files before each state's notice clock runs out.

3,158: data compromises tracked in 2024, 44 short of the record published
30 days: to tell people or a regulator under the 30-day state rules published

Copied file by file today

Files
Names
Duplicates
State law

One person, many recordsMaiden names and old addresses defeat the matching
Weeks of manual reviewThe shortest clocks run out before the list is done

The Solution

Files with personal dataStolen sheets, scans, PDFs and emails sorted, none thrown away
Records become peopleSheets, PDFs and emails merged, each merge with its reasons
Mapped to each state's lawElements and residence set the letter, the deadline and the regulator
Counsel approves each batchLetters reach the mailing vendor only after breach counsel signs

Built-in controls

Numbers masked everywhere but the mailing file
Uncertain merges decided by a reviewer
Nothing mailed or filed without counsel

What You Get

Breach counsel signs a notification list it can defend person by person and file by file.

9 days: to a signed notification list, against 4–6 weeks by hand our estimate

Letters batched by deadlineEach state's clock counted from the determination date
Regulator notices prefilledEvery answer tied to a document, ready for counsel
A sealed record for the insurerMerges, approvals and filings on an append-only trail

From the leak to the letters

The data breach review that finds 38,900 people in a stolen data set

Nine features as the matter moves, from the stolen shares to the regulator form, and whose work each one carries.

01The stolen files, sorted
A sort that narrows the stolen files to the ones that name someone
How it works
- Reads the finance share, the HR share and the billing mailbox, scans and attachments included
- 58,640 of 412,000 files hold personal data, 14.2% of the leak
- Files with no one in them are kept and logged, never discarded
Review leadPuts the review team on the files that name people, so no reviewer is paid to open the hundreds of thousands that name nobody.
02A cited claims row
Each name and element cited to its file and row, with numbers masked
How it works
- Names, addresses and each data element read from the files that hold personal data
- Each value cites its file and its page, row, cell or message
- A click opens the source passage, with numbers masked to the last four digits
- Each view is logged, and a reviewer can flag a wrong reading
Second-level reviewerChecks a reading against the row it came from in one click, with no spreadsheet of copied values to take on trust.
03One person, six records
Person matching that joins records across files, maiden names included
How it works
- Here six records: a payroll row, a tax form, a deposit form, a license scan, a claims row and an email
- Matched on SSN, member ID, birth date with a name variant, phone and address
- Merged at 97% confidence; below 90% a reviewer decides
Review leadKnows that six records are one person before the letters are built, so nobody is mailed twice and nobody is merged away.
04Elements against the law
An element grid that marks which exposed items trigger a letter
How it works
- Each element by each record, each mark opening its passage
- Each element checked against the rule where the person lives
- A bank account number without its access code does not trigger a letter alone
- Residence comes from the latest dated address, here the payroll record over an older license
Breach counselSees why a person gets a letter, element by element, and which paragraphs it must carry, before signing the list.
05The law matrix
A notification-law matrix approved once, then applied to each person
How it works
- Per state: the elements that trigger a letter, the deadline, the regulator and the head count
- Version 2026.10, approved by breach counsel before the mapping ran
- A rule change re-runs the mapping for each person it touches
- A state with no fixed days goes to counsel as an open question
Breach counselApproves the law once for the matter; no spreadsheet is rebuilt for each state and each element.
06The notification map
A notification map shaded by each state's share of exposed SSNs
How it works
- 38,900 people by state of residence, each tile with its count and first deadline
- The shading switches to health information or to who needs a letter
- A ribbon runs from day 0 to day 60, with today at day 26
Breach counselSees whom the client owes a letter, in which states, and which clock runs out first, without assembling it from spreadsheets.
07One state, opened
A state panel with its people, its clocks and its waiting approval
How it works
- The deepest-red state: 1,734 people, 1,618 needing a letter, 1,412 with an SSN
- 81% of its people have an SSN exposed, mostly payroll staff
- Its regulator notice is due in 4 days under a 30-day rule
Breach counselStarts with the deadline closest to running out, and approves its letters and its regulator notice from one place.
08Letter batches
Letter batches cut by deadline, each letter filled from its person's files
How it works
- 24,900 letters in five batches, from the 30-day states to the rest
- The first batch of 862 is mailed; the next waits for counsel
- Each letter's variables come from that person's own elements, shown in blue
- The vendor receives only approved, encrypted files
Client chief operating officerReads the exact letter the client's patients and staff will receive, each listed item drawn from their own records, and approves the wording.
09Regulator notices
A regulator notice tracker whose forms arrive with cited answers
How it works
- 12 notices, each with its rule, people count, due date and status
- The form due first arrives with 6 of 6 answers prefilled
- Each answer cites its source, from the forensic report to the counsel memo
- Only counsel files; the confirmation lands on the matter's trail
Breach counselReviews six cited answers instead of drafting a regulator form from scratch four days before it is due.

A maiden name, a shared name and sixteen locked archives caught before mailing

What the review turned up in this matter before a single letter left.

One hygienist, six files, one letter

She appears once under her maiden name with a periodontal code, once at an old address. Merged at 97%, she gets one letter, with the health paragraph, since she is also a patient.

Two people behind one name

The review lead split a record that joined two people with the same name and different dates of birth. Left merged, one of them would have heard nothing.

Archives no one can open yet

16 password-protected archives are logged and kept. The client was asked for the passwords and none has arrived, so the gap stays on the record.

Twelve corrections from one check

A second-level reviewer checked 1,945 people against their files: 99.4% matched. The 12 corrections were 7 wrong states, 3 missed elements and 2 wrong merges, each re-mapped.

Around the list

More of the data breach review: scans, shading, the trail and the mail house

What the reviewers, counsel and the client open around the map.

Table of the files that expose the most people: a claims export with 11,860, a past-due sheet with 6,950 and 3,480 license scans — **The files that name the most people**The claims export alone names 11,860 people, the past-due sheet 6,950. Each row opens a masked passage.

Masked passage from a scanned driver's license image: the license number shortened to four digits, a maiden name and a date of birth — **A license scan, read as text**Images are read too: a driver's license, its number cut to the final four, matched to the payroll record on birth date and first name.

Notification map reshaded by the share of people with health information exposed, with 2,300 such people in the summary beside it — **The same map, shaded by health data**Switched to health information, the shading shows where patients were exposed: 2,300 people whose letters carry the health-privacy paragraph.

Lower half of a state panel: data elements exposed, letters to 1,618 people, a regulator notice due in 4 days and 96 patients flagged — **Deadlines and the regulator, in one panel**Lower in the state panel: letters to 1,618 people due on day 60, the regulator notice in 4 days, and 96 patients with health content.

Matter log, newest first: two masked passages viewed by breach counsel, a prefilled regulator form, a batch approval, filings and a vendor receipt — **A trail the insurer can read**Each view, draft, approval, filing and vendor receipt, by who and when. The two passages opened above sit at the top as logged views.

Mailing vendor settings: encrypted transfer with a two-person release, 24 months of credit monitoring and returned mail reported daily — **The handoff to the mail house**An encrypted file, a secure transfer and a two-person release. Anyone with an SSN exposed is offered 24 months of credit monitoring.

Agents and their lines

The agents find the people; who gets told stays with counsel

Each one readies a step for a reviewer or for counsel, then hands it over.

File sorter

Sorts the stolen files and finds those that hold personal data, scans and images included.

Never discards a file: one with no personal data is kept and logged

Element extractor

Reads names, addresses and each data element, cited to the file and its page, row or cell.

Never shows a full SSN outside the encrypted mailing file

Person resolver

Merges person records into people and shows the anchors that matched them.

Never merges below the confidence threshold without a reviewer

Residence finder

Picks each person's state of residence from the latest dated address.

Never guesses a state: a person with no usable address goes to counsel

Law mapper

Applies the approved matrix to each person: letter or not, deadline, regulator and letter content.

Asks counsel when a rule is unclear and decides nothing itself

Notice drafter

Drafts the letter batches, the mailing file and each regulator notice, every answer cited.

Never mails or files anything
Never contacts the client, a person or a regulator

Counsel recorded why 14,000 exposed people need no letter

The calls that change who is told stay with named roles, and each one is logged.

Who gets a letterPeople with only a name, an address or a date of birth exposed were left off the mailing by counsel's recorded decision, which traces to their files.

Merges the agents are unsure ofBelow 90% confidence a reviewer merges or keeps two records apart; 19 such merges are waiting.

The law itselfBreach counsel approves the matrix and each change to it; where a state sets no fixed days, the firm's target applies and counsel is asked.

Each filingOnly counsel files a regulator notice, and the client approves the letter wording. Whoever merges a record does not run the quality check on it.

Breach counsel on merges, masked numbers and state rules

What is data breach review?

Data breach review finds each person and data element in a stolen data set, so counsel can tell the right people and regulators in time. Here agents sort the files, cite each element, merge each person across files, find where they live and apply that state's rule; counsel approves each batch.

How are two records judged to be the same person?

It matches on anchors, strongest first: SSN, insurance member ID, birth date with a name variant, phone and address, and shows which ones matched. A merge below the confidence threshold goes to a reviewer, and a reviewer can split a record back out.

Can it read scans, images and email attachments?

Yes. Spreadsheets, PDFs, scanned forms, license images and emails with their attachments are read, and each element is cited to its page, row, cell, image or message.

How does it apply a different breach law in each state?

Counsel approves a notification-law matrix for the matter: per state, which elements trigger a letter, the deadline and the regulator. An agent applies it to each person's elements and state of residence, re-runs it when a rule changes, and asks counsel where a rule is unclear.

Who can see a full SSN?

Nobody on a screen. Each screen and export shows only the final four digits. Full numbers sit only inside the encrypted file for the mailing vendor, and each view of a source passage is logged.

eDiscovery & Litigation Support