The incident bench, counsel leg
The documented breach counsel bench
When an incident hits, the responder is one of three hires: the second is breach counsel, the law firm that directs the response under privilege and owns the notification decisions. This page documents the counsel leg from public sources: every law firm named on Mandiant's published risk-partner page (cloud.google.com/security/partners/cybersecurity-risk-partners, read October 20, 2026), with what each firm's own site documents kept separate from that citation.
This page is an informational directory. It is not a ranking, not an endorsement, not a certification, not legal advice, and not a lawyer referral service. No firm paid to appear. Which counsel to retain is a legal decision this page cannot make for anyone.
Firms whose own sites document the practice
14 of 35 named firms showed breach, cyber incident, or data privacy practice language on their own websites in the October 2026 verification pass. Each entry names what was found.
BakerHostetler
United StatesDocuments incident response practice language on its own site (verified October 2026), and is named on the roster. Site: bakerlaw.com.
Baker McKenzie
GlobalDocuments cybersecurity practice language on its own site (verified October 2026), and is named on the roster. Site: bakermckenzie.com.
The Beckage Firm
United StatesDocuments cybersecurity, incident response, data breach practice language on its own site (verified October 2026), and is named on the roster. Site: thebeckagefirm.com.
Blakes
CanadaDocuments cybersecurity practice language on its own site (verified October 2026), and is named on the roster. Site: blakes.com.
Clyde & Co
United KingdomDocuments data protection and privacy practice language on its own site (verified October 2026), and is named on the roster. Site: clydeco.com.
King & Spalding
United StatesDocuments incident response practice language on its own site (verified October 2026), and is named on the roster. Site: kslaw.com.
Mayer Brown
United StatesDocuments cybersecurity practice language on its own site (verified October 2026), and is named on the roster. Site: mayerbrown.com.
Mintz
United StatesDocuments cybersecurity practice language on its own site (verified October 2026), and is named on the roster. Site: mintz.com.
Morrison Foerster
United StatesDocuments cybersecurity, ransomware practice language on its own site (verified October 2026), and is named on the roster. Site: mofo.com.
Mullen
United StatesDocuments cybersecurity, incident response, breach response practice language on its own site (verified October 2026), and is named on the roster. Site: mullen.law.
Norton Rose Fulbright
GlobalDocuments cybersecurity practice language on its own site (verified October 2026), and is named on the roster. Site: nortonrosefulbright.com.
Torys
CanadaDocuments data breach practice language on its own site (verified October 2026), and is named on the roster. Site: torys.com.
Wilson Sonsini
United StatesDocuments cybersecurity practice language on its own site (verified October 2026), and is named on the roster. Site: wsgr.com.
Woods Rogers Vandeventer Black
United StatesDocuments cybersecurity, cyber incident practice language on its own site (verified October 2026), and is named on the roster. Site: woodsrogers.com.
Named on the roster, practice not yet checked
21 firms are named on the roster, but their websites render through JavaScript or block automated reading, so their practice pages have not been independently checked yet. The roster citation stands on its own; these entries upgrade as the verification pass reaches them.
Alston & Bird
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: alston.com.
Cooley
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: cooley.com.
Crowell
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: crowell.com.
Debevoise & Plimpton
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: debevoise.com.
DLA Piper
GlobalNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: dlapiper.com.
Eversheds Sutherland
United KingdomNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: eversheds-sutherland.com.
Fasken
CanadaNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: fasken.com.
Freshfields
United KingdomNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: freshfields.com.
Herbert Smith Freehills
United KingdomNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: herbertsmithfreehills.com.
Hogan Lovells
GlobalNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: hoganlovells.com.
Hunton Andrews Kurth
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: huntonak.com.
Kennedys
United KingdomNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: kennedyslaw.com.
Kirkland & Ellis
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: kirkland.com.
Orrick
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: orrick.com.
Osler
CanadaNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: osler.com.
Paul, Weiss
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: paulweiss.com.
Ropes & Gray
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: ropesgray.com.
Shook
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: shb.com.
Sullivan & Cromwell
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: sullcrom.com.
Wiley
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: wiley.law.
Willkie
United StatesNamed on the roster; practice pages not yet independently checked (site renders via JavaScript or blocks automated reading). Site: willkie.com.
What this directory does not do
Not a ranking or a recommendation. Firms appear alphabetically within their evidence tier. No score, no order of merit, no “best” list. Which counsel to retain is a legal decision only a client and its advisors can make.
Not a certification or an endorsement. Nothing here certifies any firm as a breach specialist. Several states restrict specialization claims in lawyer advertising; this page makes none, for anyone.
No reviews or testimonials. Client reviews of counsel are restricted in a number of jurisdictions, and a review section would turn an informational directory into something this platform will not operate.
No firm paid to appear, and no referral fees, ever. Inclusion is not purchasable, and the platform never takes a fee for connecting a reader with any firm. Paid placement and paid matching are the two monetizations this section will never carry.
Not legal advice, and not a lawyer referral service. This page is published information about a public roster and firms' own published practices. It cannot advise any reader on which firm to hire.
Frequently asked questions
Why do these firms appear here?
Every firm on this page is named on Mandiant's published cybersecurity risk-partner page at cloud.google.com/security/partners/cybersecurity-risk-partners, read October 20, 2026. That page names 54 partners: 35 law firms and 19 insurance-market participants. The roster is the base citation for this bench. It is a platform-published, self-curated list by the market's largest incident response firm, and this page treats it as exactly that: citable evidence of one vendor's published network, not an assessment of any firm's capability.
What does the site-verified tier mean?
Firms in the first section showed breach, cyber incident, or data privacy practice language on their own websites in our October 2026 verification pass, and each entry names the terms found. Firms in the second section are named on the roster, but their websites either render through JavaScript or block automated reading, so their practice pages have not been independently checked yet. The two tiers are kept separate on purpose: what a firm's own site documents is different evidence from what another platform's page names.
How is this different from legal directories like Chambers or Best Lawyers?
Those publications rank law firms by reputation and interviews. This page does not rank anyone. It documents, with dates and named sources, what is publicly published: which firms a major incident response platform names as partners, and what those firms' own sites say about their breach practices. Evidence over reputation, and nothing here substitutes for a client's own diligence and conflicts checking.
How do I engage breach counsel?
Through your own diligence: your general counsel, your existing outside counsel, or your insurance carrier's breach response program, which typically includes a counsel network. Our breach counsel explainer covers the role and when privilege makes counsel the first call. This page cannot and does not direct anyone to a specific firm.