Law Firm Cybersecurity: Client Data, Ethics, Email Fraud

A law firm is a concentrated store of other people’s secrets. Deal terms, medical records, and the wiring instructions for a closing all sit in the same inbox. That makes a firm an attractive target, and it’s why law firm cybersecurity is also a professional responsibility issue. This guide covers 3 sources of risk: the ethics rules that apply, the notice duties a breach can trigger, and business email compromise scams aimed at trust accounts. The sources are ABA ethics opinions, the FBI, CISA, and NIST. Together they help inform a baseline for US practices, subject to the rules adopted in each jurisdiction.

TL;DR

Law firms hold sensitive records and handle transactions that attackers may try to redirect through email. State professional conduct rules generally require reasonable care with client information; ABA Model Rules and opinions provide guidance, but lawyers must check the rules adopted in their jurisdiction. Breaches may trigger ethics, statutory, contractual, and insurance notice duties. Business email compromise can cause direct financial loss. Independent callback verification using a previously trusted number helps prevent fraudulent wire changes, but it isn’t a guarantee. MFA, email authentication, vendor checks, an AI policy, and suitable cyber insurance address different risks. The 90-day plan below is a suggested starting schedule, not a promise of compliance or completion for every firm.

Why Law Firms Are a Target for Cyberattacks

Firms attract 3 kinds of attacker at once. Extortion crews want to lock files, fraudsters want to redirect a wire, and state-linked groups want to read privileged email. The FBI’s 2025 IC3 report logged 1,008,597 complaints and $20.877 billion in reported losses for the year. Business email compromise alone accounted for 24,768 complaints and about $3.05 billion, and ransomware drew 3,611 complaints. Firms appear on both lists because they move client money and hold files that are expensive to lose.

The attack paths are ordinary: a phished password, a push notification approved by habit, or a server nobody patched. Microsoft’s Digital Defense Report for 2025 found that more than half of attacks with a known motive were financial, which usually means extortion.

Patching matters because known software weaknesses can remain exposed after an update is available. The 2026 Verizon DBIR found ransomware present in 48% of the breaches it studied. Software vulnerabilities were the way in for 31% of breaches, now outranking stolen credentials. Third parties were involved in 48% of breaches. IBM’s 2026 Cost of a Data Breach study put the global average cost at $4.99 million, a record.

The profession’s own survey adds context. The ABA’s 2023 Cybersecurity TechReport found that 29% of respondents said their firms had experienced a security breach or incident, while 19% didn’t know. The survey question covered events such as lost devices as well as hacking, so the 29% shouldn’t be read as a rate of confirmed data breaches. The findings describe 2023 survey responses, not the full market in 2026.

What Client Data Law Firms Hold and Where It Lives

A single matter file bundles data that would be regulated separately anywhere else. A personal injury file holds medical records and Social Security numbers. An M&A file holds unreleased financials and employee lists. A real estate closing holds wiring instructions that will move 6 or 7 figures. Attackers know the pile is worth more than its parts.

That data lives in more places than most partners realize. Email matters most, because it’s the de facto document system for most firms and the least controlled. Add personal phones, home laptops, e-discovery platforms, court portals, and the trust account bank portal. The inventory runs to 8 or 10 systems before anyone counts the vendors behind them.

Some subsets of that data carry their own rulebook. A lawyer whose services to a health plan involve access to protected health information is a HIPAA business associate under HHS guidance. That means a business associate agreement is required and the firm is directly liable under HIPAA. The FTC Safeguards Rule reaches businesses engaged in financial activities such as mortgage brokering. The FTC’s guidance doesn’t list law firms, so most practices won’t be covered, but a firm that runs a covered financial activity should get an opinion.

The Ethics Rules Behind Law Firm Cybersecurity

The ABA Model Rules guide professional conduct standards, but they aren’t binding by themselves. Each US jurisdiction adopts and interprets its own rules, so lawyers must check the version that applies to their practice and any relevant state ethics opinions. The model provisions focus on reasonable efforts in light of the information at risk. Four are especially relevant.

Competence Means Knowing the Technology

Comment 8 to ABA Model Rule 1.1 says lawyers should keep abreast of the benefits and risks of relevant technology. The ABA added that language in 2012. Jurisdictions have adopted differing technology-competence provisions, and their exact requirements may vary. Lawyers should consult their own jurisdiction’s rules and guidance rather than assume the ABA wording controls directly. Handing technical tasks to a contractor doesn’t remove the need to supervise the work.

Confidentiality Means Reasonable Efforts

ABA Model Rule 1.6(c) calls for reasonable efforts to prevent unauthorized access to or disclosure of information relating to a representation; local rules control the lawyer’s binding duties. ABA Formal Opinion 477R, issued in May 2017, turned that into a test. The factors are the sensitivity of the information, the likelihood of disclosure without extra safeguards, the cost of those safeguards, and whether they’d impair the representation. Unencrypted email passes that test for routine matters once basic security is in place; highly sensitive matters warrant encryption or a secure portal. Its 7 considerations are the best short checklist in any of the ABA ethics opinions. Understand the threat. Know how information is transmitted and stored. Use reasonable security. Decide how each communication is protected. Label confidential information. Train staff. Vet vendors.

Communication Means Telling Clients When Something Goes Wrong

ABA Model Rule 1.4 addresses keeping clients reasonably informed, while adopted state rules determine binding duties. In that context, ABA Formal Opinion 483, issued in October 2018, applied that rule to a law firm data breach. It defines a breach as an event where material client confidential information is misappropriated, destroyed, or otherwise compromised. An event that significantly impairs the lawyer’s ability to perform services also counts, so ransomware that locks files without stealing anything qualifies. The opinion requires reasonable efforts to monitor for breaches, stop one in progress, restore systems, and work out what happened. When a breach involves material client confidential information, or there’s a substantial likelihood it does, the lawyer must notify the client. The ethics duty runs to current clients; former clients may be owed notice under state law or a contract instead.

Supervision Covers Staff, Vendors, and Remote Work

ABA Model Rule 5.3 addresses supervision of nonlawyers who assist a lawyer, and ABA ethics guidance applies similar reasoning to vendors. The applicable state rule governs the precise duty. Formal Opinion 498, from March 2021, extended the same thinking to virtual practice. It expects lawyers to review terms of service, keep updates current, secure home routers, and disable smart speakers during client discussions. It also calls for a bring-your-own-device policy that covers VPN use, phishing training, and remote wipe.

Read together, these ABA model provisions offer a framework for firms to assess their state-specific duties and protect information in proportion to the risk. It tells clients when something goes wrong, and it watches everyone who touches the data. That’s law firm cybersecurity as a professional obligation, and the rest of this guide is about meeting it.

Who You Must Notify After a Law Firm Data Breach

Notice obligations stack, and each one runs on its own clock. Opinion 483 is only the first layer. The NCSL’s tracker of state breach notification laws confirms that all 50 states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have such a law. Each requires private businesses to notify affected individuals when personal information is exposed. A firm with clients in several states will owe notice under several statutes at once.

Regulated data adds more layers. A HIPAA business associate must tell the covered entity without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. A covered financial institution must notify the FTC as soon as possible and no later than 30 days after discovering a defined notification event involving unauthorized acquisition of at least 500 consumers’ unencrypted customer information. Under the rule, certain encrypted data also counts if an unauthorized person accessed the encryption key. Corporate clients add their own terms through outside counsel guidelines, many modeled on the ACC’s Model Information Protection and Security Controls, with deadlines shorter than any statute. The insurer has a notice clause too, and law firm cyber insurance can be lost by missing it.

Who to notify	What triggers it	Deadline
Current clients (ethics duty)	Material client confidential information involved or likely involved	Promptly, once impact is assessed
Affected individuals and state regulators	Personal information as each state defines it	Varies by state
HIPAA covered entity (if the firm is a business associate)	Breach of unsecured protected health information	No later than 60 days
FTC (covered financial institutions only)	Unauthorized acquisition of at least 500 consumers’ unencrypted customer information, as defined by the rule	As soon as possible, within 30 days after discovery
Clients with outside counsel guidelines	Contract terms, often modeled on ACC controls	Per contract, often shorter than statute
Cyber insurer	Reportable incident under the policy	Per policy; late notice may put coverage at risk

The firm must check every notice deadline; a policy or client contract may require action before a statutory deadline. The NYC Bar Opinion 2024-3 from July 2024 adds a gloss on the ethics layer. Clients should be told at the earliest time after an incident is identified and its impact assessed, which argues against sitting on a breach while forensics run. The same opinion also addresses the ransom question. There’s no ethical prohibition on paying and no obligation to pay. A payment to a sanctioned party exposes the firm to OFAC penalties, though, so that decision belongs with breach counsel and the insurer.

Build the contact list and the notice templates before anything happens. Breach counsel and the insurer go first, because both will want to control forensics and the wording of every later notice, and the clock-driven notices follow. A firm that assembles that list mid-incident will miss something. The WilmerHale litigation discussed later shows how the gap between discovery and notice becomes a cause of action.

Business Email Compromise and the Trust Account Wire Playbook

Business email compromise needs no malware. The attacker compromises one inbox on any side of a transaction, reads along for weeks, then sends a plausible change to the wiring instructions. The FBI’s public service announcement on the subject tallied 277,918 incidents and $50.87 billion in exposed losses between October 2013 and December 2022. It singled out real estate, because criminals monitor transactions involving buyers, sellers, attorneys, title companies, and agents. The 2025 IC3 report counted 12,368 real estate complaints with $275.1 million in losses in a single year.

Recovery is possible when the firm moves fast. The FBI’s congressional report on wire fraud says the FBI Recovery Asset Team handled about 1,700 incidents in 2021, covering roughly $445 million. It froze more than $328 million of that, a success rate near 75%. One case from the 2024 IC3 report shows the upside of speed: a spoofed email requested a $956,342 closing wire, and $955,060 of it was recovered.

This trust account wire procedure can reduce the risk of common instruction-change scams. It requires staff time and consistent follow-through:

1. Treat every new or changed wiring instruction as unverified, whoever it appears to come from.

2. Call back on a number from the engagement letter or an earlier in-person exchange, never one from the requesting email.

3. Set a change code with the client and the other side at intake, and require it on any change.

4. Use two-person release: the person who verifies can’t be the person who sends.

5. State in the engagement letter and closing instructions that the firm never changes wiring instructions by email.

6. Check the sender’s domain character by character, and look for a mismatched reply-to address.

7. If money moves, call the bank for a recall, then file at ic3.gov, then notify the insurer and the client.

Bar associations have repeatedly warned lawyers about wire-change scams during property transactions. The Florida Bar warning on this scam describes the same pattern and the same fix. Assume the email is compromised, call the original contact on a number you already had, and agree a change code in advance. Speed matters because stolen funds can move through other accounts quickly. A timely bank recall and law enforcement report may improve the chance of recovery, but recovery isn’t assured.

Email Authentication and Identity Controls

Email authentication helps receiving systems detect messages that misuse a firm’s domain. SPF identifies authorized sending servers, while DKIM gives receivers a way to check a message’s cryptographic signature. DMARC uses aligned SPF or DKIM results and publishes a policy for receivers, such as none, quarantine, or reject. NIST’s Trustworthy Email guidance, SP 800-177, discusses these controls alongside TLS in transit. When a receiver enforces a DMARC policy of reject, it can reject unauthorized exact-domain spoofing. DMARC doesn’t block lookalike domains, deceptive display names, or fraudulent mail sent from compromised legitimate accounts. Independent verification of wire changes remains necessary.

Google made this hard to avoid. Since February 2024, its sender guidelines have required every sender to Gmail to use SPF or DKIM, encrypt with TLS, and keep spam rates below 0.3%. Senders of 5,000 or more messages a day also need DMARC, domain alignment, and one-click unsubscribe. A common rollout starts at a monitoring policy, checks legitimate sending services, and moves toward reject when authentication is properly configured.

The second control is identity, which is where a law firm cybersecurity plan should spend its MFA effort. Microsoft’s 2025 Digital Defense Report found that more than 97% of identity attacks are password spray or brute force. Modern multifactor authentication cuts the risk of compromise by more than 99%. Phishing still works, which is why CISA’s MFA hierarchy ranks methods by how well they survive a convincing fake login page.

MFA method	CISA ranking	Why
FIDO/WebAuthn keys and passkeys, or PKI smart cards	Strongest, phishing resistant	The credential is bound to the real site
Authenticator app codes, or push with number matching	Strong	Number matching stops blind approval
Push without number matching	Weaker	Open to approval fatigue
SMS or voice codes	Last resort	Vulnerable to phishing and SIM swap

Roll it out in order of blast radius. Anyone who can approve a wire gets phishing-resistant MFA first, on email, the document system, and the bank portal. Everyone else gets an authenticator app with number matching. Any MFA beats none, so don’t delay the rollout waiting for hardware keys. Retire SMS last.

Cloud and Vendor Due Diligence

The bar approved cloud storage more than 15 years ago, provided the lawyer did the homework and could show it. NYSBA Opinion 842, from September 2010, said a lawyer may store client confidential information online with reasonable care, then defined that care. The provider must have an enforceable obligation to preserve confidentiality and to notify the lawyer if it’s served with process. The lawyer must investigate the provider’s security, confirm the ability to purge the data and move it elsewhere, and reconfirm periodically. Florida Bar Opinion 12-3 reached the same result.

The contract is the control. Before any system holds client data, confirm these 6 things in writing:

· A confidentiality clause that survives termination.

· A breach notice clause with a deadline short enough to meet the firm’s own clocks.

· Where the data is stored, who at the vendor can access it, and whether subcontractors can.

· Export and deletion rights on termination, in a format the firm can use.

· MFA and encryption available on the firm’s account, and switched on.

· An annual re-check, because terms change.

The NYC Bar’s 2024 opinion offers smaller firms relief: they may reasonably rely on the stated security features of well-known vendors rather than commissioning audits. That doesn’t remove the duty to read the terms and switch on the protections the vendor offers. Keep the vendor list current, because it’s the list the firm needs when a law firm data breach starts with a third party. Vendor review is a standing part of law firm cybersecurity, and the ABA ethics opinions expect the firm to know who holds what.

Generative AI Tools and Client Confidentiality

The confidentiality rule doesn’t change when a lawyer opens a generative AI tool. What changes is where the data goes and whether the tool learns from it. ABA Formal Opinion 512, issued in July 2024, lands on a simple rule. Lawyers must have a reasonable understanding of the capabilities and limits of the tools they use, and they must vet AI vendors the same way they’d vet any other vendor.

The self-learning question is the one that bites. Many consumer AI tools train on what users type, so one client’s information can surface in another user’s output. Opinion 512 requires a client’s informed consent before information relating to the representation goes into such a tool, and boilerplate consent in an engagement letter isn’t enough. The Florida Bar reached the same place in Opinion 24-1 in January 2024, and added that lawyers must review a tool’s retention and self-learning policies first.

California’s practical guidance from the State Bar goes further on the input side. A lawyer must not put confidential client information into a generative AI tool that lacks adequate protections. The lawyer should read the terms of use to confirm the provider won’t train on inputs. Supervisory lawyers should set written policies on permissible use, and overreliance on AI output is inconsistent with the active practice of law.

The firm-level answer is a short approved-tools policy owned by a supervising lawyer. It names the approved tools and account tier, since enterprise contracts typically exclude training on inputs and consumer tiers often don’t. It says what may never be entered and who signs off on exceptions. Of all the ABA ethics opinions, 512 is the one most firms haven’t yet put into practice.

Law Firm Cyber Insurance as a Security Control

Older survey findings can show a firm’s historical starting point, but they aren’t current insurance market figures. In its 2023 survey analysis, the ABA Cybersecurity TechReport reported that 40% of responding firms had cyber liability insurance, from 31% of solo practices to 59% of firms with 50 to 99 lawyers. It also reported an incident response plan at 34% of firms, two-factor authentication availability at 54%, file encryption at 48%, and email encryption at 42%. These are 2023 respondent measures, not estimates of adoption in 2026.

The application is a free audit. Insurers ask whether the firm has MFA on email and remote access, tested backups, email filtering, endpoint protection, and a written incident response plan. A “no” on the wrong question can mean a declined application, a higher premium, or an exclusion for the loss the firm is most likely to suffer. Working through the questionnaire before applying tells a firm where its law firm cybersecurity stands, in the insurer’s terms. The ABA’s Standing Committee on Lawyers’ Professional Liability has published a guide to choosing a policy.

Read the policy for 5 things. First, whether social engineering and funds transfer fraud are covered. A standard cyber policy can exclude a wire sent by an employee who was tricked, and that’s the business email compromise loss a firm is most likely to face. Second, notification and credit monitoring costs, which scale with the number of people affected. Third, business interruption. Fourth, who controls the choice of breach counsel and forensics, because the insurer usually does. Fifth, the notice deadline. Corporate clients increasingly require law firm cyber insurance as a condition of engagement, and the ACC’s outside counsel controls list it alongside breach reporting. A law firm data breach without coverage lands on the partners.

A 90-Day Law Firm Cybersecurity Baseline for Small Firms

This is a suggested sequence for setting initial priorities, not a guarantee that a firm can complete every control or meet its legal duties in 90 days. Firms with older systems, complex vendors, or higher client-data risks may need more time and specialist review.

CISA’s 4 suggested actions and NIST’s 6 functions offer complementary ways to organize the work. CISA’s Secure Our World guidance asks every business to recognize and report phishing, use strong passwords, turn on MFA, and keep software updated. It states that no business is too small to be a target. The NIST CSF 2.0, released in February 2024, organizes the same work under Govern, Identify, Protect, Detect, Respond, and Recover, and ships with quick-start guides for small organizations.

Days 1 to 30: Identify and Lock the Doors

Start with an inventory: every system that holds client data, who has access, and which vendor runs it. Then turn on MFA for email, the document system, and the bank portal, starting with the people who can move money. Require a password manager for everyone. Switch on automatic updates for operating systems, browsers, and the practice management client, since a software vulnerability is now the most common way in. Some steps involve settings already available, while others may require licenses, hardware, or paid support.

Days 31 to 60: Protect and Train

Publish SPF and DKIM if they’re missing, then set DMARC to quarantine and move to reject once the reports look clean. Write the wire callback rule into the engagement letter, and run the two-person release on a real wire so the steps are familiar. Run phishing training with a one-click way to report a suspicious message, because reporting is the half that catches real attacks. Adopt the bring-your-own-device policy from Opinion 498, set up offline or immutable backups, and restore a file to prove they work.

Days 61 to 90: Detect, Respond, Recover

Write a 1-page incident response plan that lists the notification stack, the insurer’s hotline, the bank’s fraud line, and breach counsel’s cell number. Then run a tabletop exercise on a fake wire change request and see where the process breaks. A 1-page plan with the right phone numbers beats a 40-page plan nobody can find during an incident.

Govern keeps the other 5 functions alive. Someone at partner level owns law firm cybersecurity by name. That person reviews the inventory and the vendor list once a year and reports to the partnership on what changed. That partner also owns the law firm cyber insurance renewal, since the application will ask about everything above.

Lessons From Recent Law Firm Data Breaches

Recent cases show where the cost of a law firm data breach lands and how long it takes to arrive.

Orrick: The Cost Lands Years Later

A federal court in the Northern District of California gave final approval in November 2024 to an $8 million class settlement over the 2023 Orrick breach. Later reporting on the settlement states that Orrick notified 638,023 individuals that their information may have been accessed or taken. The case illustrates how a firm’s files can include records belonging to its clients’ customers or employees. The number of people notified is one factor in the exposure, but settlement amounts also depend on the claims, evidence, alleged harm, and negotiated terms. They can’t be calculated from a simple per-person rate.

Bryan Cave and Mondelez: Your Client’s Employees Are Your Plaintiffs

Another case shows how records entrusted to outside counsel can expose a client’s employees. The Bryan Cave settlement reported by the ABA Journal in October 2024 saw the firm and its client Mondelez agree to pay $750,000. The class was about 53,000 Mondelez employees whose data may have been exposed when the firm’s network was hacked. The plaintiffs were the client’s people, whose information sat in the firm’s files because the firm did employment work. The second-order victim is where the litigation comes from.

Williams & Connolly: Email Is the Target

In October 2025, Williams & Connolly told clients that a small number of attorney email accounts had been accessed through a zero-day vulnerability. The intrusion was attributed to a nation-state linked actor that was targeting the legal sector. The inbox is the prize for a state actor as much as for a wire fraudster. Phishing-resistant MFA and prompt patching are the controls that address it.

WilmerHale: The Clock Between Discovery and Notice Gets Litigated

A putative class action filed in July 2026 against WilmerHale alleges a third party obtained a limited set of client information. The firm said it discovered the incident in early May 2026 and notified clients on July 10. The complaint’s theory turns on that gap. Whether 2 months was reasonable will be argued. The interval between discovery and notice is now a standard allegation, and a pre-built notification stack gives a firm a documented reason for every day.

The 4 cases map onto the earlier sections. The inventory tells the firm how many people it holds data on. The notification stack gives it a defensible timeline. Email authentication and MFA close the door that criminals and state actors share. None of that law firm cybersecurity work costs much relative to the settlements above.

Where Law Firm Cybersecurity Starts

The ethics rules already require reasonable security, so the question is whether a firm’s practice matches the duty it has carried since 2012. The controls that matter cost little. MFA, DMARC, a password manager, offline backups, and a 1-page response plan are configuration work for a small firm, and the insurance application will ask about every one of them. Two things are worth doing this week. Write the wire callback rule into the engagement letter, and build the notification contact list before a breach forces the firm to improvise it. Law firm cybersecurity is a professional obligation with a known shape. A firm that treats it that way will have a better answer when a client’s general counsel asks what the firm has done.

FAQs

What is law firm cybersecurity and why is it different from other small business security?

Law firm cybersecurity covers the measures a firm uses to protect confidential client information and client money. Professional conduct rules adopted by each jurisdiction set binding duties, while ABA Model Rules offer guidance. A breach involving material client information may require notice to current clients.

Are law firms required by ethics rules to have cybersecurity?

Lawyers generally have duties of competence and confidentiality under their jurisdiction’s professional conduct rules. ABA Model Rule 1.1 Comment 8 discusses relevant technology, and Model Rule 1.6(c) addresses reasonable safeguards. Lawyers must check their adopted state rules and opinions for the binding standard.

What does ABA Formal Opinion 483 require after a data breach?

Opinion 483 requires reasonable efforts to monitor for breaches, stop one in progress, restore systems, and determine what happened. When a breach involves material client confidential information, or is likely to, the lawyer must notify affected current clients.

Do lawyers have to notify former clients of a breach?

Opinion 483 finds no ethics duty to notify former clients. State breach statutes, HIPAA, or the client’s contract may still require it, so check each applicable law and contract before leaving former clients out.

Is it ethical for a law firm to pay a ransomware demand?

The NYC Bar’s 2024 opinion found no ethical prohibition on paying a ransom and no obligation to pay one. Paying a sanctioned party can violate OFAC rules, so make the decision with breach counsel and the insurer involved.

How do business email compromise scams target law firms?

Attackers compromise an email account belonging to a client, a title company, an agent, or the firm. They read the thread for weeks, then send a last-minute change to the wiring instructions that looks routine. It works because few firms verify wire changes by phone.

What should a firm do in the first hour after a fraudulent wire goes out?

Call the sending bank first and request a recall. Then file a complaint at ic3.gov so the FBI’s Recovery Asset Team can ask the receiving bank to freeze the funds. Notify the cyber insurer and the client next.

Can lawyers send client information by unencrypted email?

Usually, for routine matters, once the firm has basic security in place. Opinion 477R concluded that unencrypted email is generally acceptable but that highly sensitive matters warrant encryption or a secure portal.

What is DMARC and does a small law firm need it?

DMARC uses aligned SPF or DKIM authentication and a published domain policy to help receiving servers detect unauthorized exact-domain spoofing. A reject policy can cause those messages to be rejected when receivers enforce it. DMARC doesn’t prevent lookalike domains or messages sent through a compromised real mailbox, so firms still need independent wire verification.

Which type of MFA should a law firm use?

CISA ranks FIDO/WebAuthn security keys and passkeys as the strongest option because they resist phishing. Authenticator apps with number matching are next. SMS codes are a last resort because of SIM swapping, though any MFA is better than none.

Can law firms store client files in the cloud?

Yes. Bar opinions in New York, Florida, and elsewhere have approved cloud storage for more than 15 years, provided the lawyer takes reasonable care. That means an enforceable confidentiality obligation from the vendor, a review of its security, and the ability to export and delete the data.

Can lawyers use ChatGPT or other generative AI with client data?

Only with care. ABA Formal Opinion 512 requires informed client consent before information about a representation goes into a self-learning tool, and boilerplate engagement letter language isn’t enough. Enterprise tiers that don’t train on inputs change the analysis.

Does a law firm need cyber insurance?

Cyber insurance is worth evaluating against the firm’s exposures and client contract terms. The ABA’s 2023 Cybersecurity TechReport said 40% of responding firms had cyber liability coverage; that percentage isn’t a current 2026 market measurement. Check the policy’s treatment of funds transfer fraud.

How much does a law firm data breach cost?

There’s no single reliable average for law firms alone. IBM’s 2026 study reported a global cross-industry average of $4.99 million, which shouldn’t be presented as a typical law firm cost. A court finalized an $8 million Orrick settlement after 638,023 people had received breach notices; the Bryan Cave and Mondelez agreement was reported at $750,000. Settlement size depends on each case’s claims and terms, not solely the number of people involved.

Where should a small law firm start with cybersecurity?

Start with CISA’s 4 actions: recognize and report phishing, use strong passwords, turn on MFA, and keep software updated. Then add a wire callback rule to the engagement letter and a 1-page incident response plan with the insurer’s and bank’s phone numbers.

Use up and down arrow keys to resize the meta box pane.