Glossary

Breach coach

A privacy attorney, usually from the cyber insurer's panel, who directs the first days of a data breach or ransomware response.

Also called: privacy breach coach, data breach coach, breach counsel, incident response counsel

A breach coach is a lawyer who quarterbacks a data breach or ransomware event. Most cyber policies give access to one through an incident hotline, and the fees are normally covered as breach response costs in the policy's first-party section. That makes the insurer's panel rules important: many policies require prompt notice and the insurer's consent before you hire counsel or vendors.

The coach works out which laws apply, from state breach-notification statutes to HIPAA and contractual duties, and decides who must be told and by when. The coach also engages forensic investigators, notification and call-center vendors, credit monitoring and public relations through the law firm. Routing the work this way gives communications and reports the best chance of attorney-client privilege or work product protection. It is not a guarantee: courts have ordered forensic reports produced in some breach cases when the work looked like ordinary business response.

The common mistake is losing a day calling your own lawyer, IT vendor or a negotiator before the hotline. Keep the number and policy details somewhere that survives a network outage, such as a printed copy in the incident response plan. The guide on the cyber claims process shows the sequence, and the ransomware entry explains what a coach does when extortion is involved.

Last reviewed October 10, 2026

In the index now

Related terms

Ransomware Malicious software that locks or encrypts a victim's data or systems and demands payment for the key, often with a threat to publish stolen files. Cyber extortion A demand for payment backed by a threat to encrypt, destroy or publish your data or disrupt your systems, and the cyber policy coverage that responds to it. First-party coverage Insurance that pays the policyholder directly for its own losses, such as damaged property or breach response costs, rather than defending claims by others. Third-party coverage Insurance that pays defense costs and damages when an outsider, such as a customer, patient or regulator, makes a claim against the policyholder. Business email compromise (BEC) Fraud in which a criminal impersonates an executive, vendor or client by email to trick an employee into sending money or changing payment details.

Related guides

Business email compromise and funds transfer fraud coverage A hijacked mailbox can cost you stolen payments, a data breach and a customer's misdirected invoice. Which parts a cyber policy pays and where the gaps are. A ransomware claim, step by step, from the first alert to the last settlement A hypothetical composite walkthrough of a cyber claim: breach coach, forensics, OFAC check, business interruption, state notification and third-party suits. What happens when you file a cyber claim The cyber claim from first call to payment: hotline, breach coach, forensics, retention, the income-loss claim, and why many reported claims close unpaid. Building an incident response plan your insurer will like What a cyber incident response plan needs for your policy to work: the hotline call, consent rules, evidence, legal deadlines and a tested first 24 hours. Cyber insurance: what it covers for a business What a cyber policy pays for after a breach, ransomware attack or email fraud, how limits and retentions work, and what the policy leaves out. Data breach notification laws and what they cost Every state requires breach notices, and the law that applies is where affected people live. Deadlines, regulator notices, penalties and cyber policy payouts.

Related insurers

Coalition San Francisco cyber MGA and carrier that pairs cyber, tech E&O and executive risks policies with security scanning and incident response, sold through brokers.