Richard Lutkus

Richard is a Director in the Risk Advisory practice at AlixPartners, and is based in New York. Richard helps clients solve their most complex and technically challenging digital investigation, litigation, legal risk, cybersecurity, and privacy problems. 

Richard has advised clients on a diverse array of cybersecurity matters, including privileged risk assessments, tabletop exercises, threat hunts, penetration tests, and social engineering assessments. He has also guided clients through data privacy assessments for GDPR and CCPA compliance, conducted comprehensive data mapping for global enterprises, managed endpoint interrogation for privacy risk assessments, and developed data security frameworks aligned with privacy compliance requirements. In the realm of data breach privacy, Richard has developed custom solutions for rapid PII data mining, providing early indication on the scope of exfiltrated file content. 

In addition to cybersecurity and privacy, Richard is a skilled digital forensic expert, supporting cases involving trade secret misappropriation, computer fraud, intellectual property theft, harassment investigations, and data ransom/data hijacking matters. Passionate about cryptocurrency, he also assists clients in the sector with security, web3 presence, and NFTs.

Richard holds the unique distinction of being the only attorney in the world who is not only barred in two U.S. jurisdictions, but also holds three highly technical certifications in cybersecurity (CISSP), digital forensics (EnCE), eDiscovery (EnCEP), and certified ethical hacking (CEH). Richard also serves as the National Chair of the Legal Cross-Sector Council for the FBI’s InfraGard program. 

Key Engagements

• Served as lead breach coach for dozens of clients after cybersecurity incidents, data breach events, and business-email-compromise assessments.
• Co-led an Am Law 50 law firm’s cybersecurity and data privacy practice group; served as special counsel to the firm for internal investigations, eDiscovery, and cybersecurity.
• Created a rapid data breach risk assessment product to quickly assess exfiltrated data for privacy law liability.
• Led a data privacy risk assessment of compliance with the General Data Protection Regulation and the California Consumer Privacy Act for a global data storage manufacturer.
• Managed smartphone messaging data repatriation compliance matters for several large investment banks.  
• Conducted hundreds of digital forensic computer and mobile device examinations to investigate trade secret misappropriation, white collar crime, intellectual property theft, employee malfeasance, fraud, and harassment matters.