Law firms hold exactly what attackers want. Confidential client files, settlement and closing funds that move by wire, and email that clients trust without a second thought. A five attorney practice in Augusta holds the same kind of data as a large firm downtown, usually with far less security behind it. That combination is why criminals keep coming back to legal.
Key takeaways
- Attackers target law firms for three things: confidential data, money in motion and trusted email accounts.
- The ABA Model Rules make reasonable security part of a lawyer's professional duty, not just an IT preference.
- Most of the risk is closed by a short list of basics done well: multifactor authentication, wire verification, backups you have tested and a plan for a bad day.
Why Attackers Single Out Law Firms
Confidential Information Is Valuable
Merger details, medical records in injury cases, financial statements in divorces and trade secrets in litigation are all worth money to someone. Criminals can sell the data, use it for insider trading, or threaten to publish it unless the firm pays. Even a small practice can hold years of this material in its document management system and email archive.
Money Moves Through Trust Accounts
Real estate closings, settlements and escrow payments make firms a natural target for wire fraud. The pattern is familiar: an attacker gets into an email account, watches quietly, then sends the client or the closing attorney "updated" wiring instructions at the last minute. Business email compromise is consistently one of the costliest crimes in the FBI's annual Internet Crime Report, and real estate transactions are a favorite target.
Client Email Is Trusted
Clients open messages from their lawyer immediately and act on them. An attacker who controls one attorney's mailbox can send convincing requests to every client in the contact list. That is why a single stolen password at a law firm can do so much damage.
Smaller Firms Run Leaner
Most small and mid-sized firms do not have a full time IT person, let alone a security team. Attackers know it. Automated tools scan the internet for unpatched systems and weak logins all day, and they do not care how big the firm is.
What the Ethics Rules Expect
Cybersecurity at a law firm is a professional responsibility issue, not only a technology one. The ABA Model Rules, which most states including Georgia and South Carolina base their own rules on, address it directly:
- Rule 1.1, Competence. Comment 8 says lawyers should keep up with the benefits and risks of relevant technology.
- Rule 1.6(c), Confidentiality. Lawyers must make reasonable efforts to prevent unauthorized access to or disclosure of client information.
- ABA Formal Opinion 477R. Explains how to secure communication of protected client information, including when extra measures like encryption are warranted.
- ABA Formal Opinion 483. Covers a lawyer's obligations after a data breach, including monitoring for breaches and informing clients when their information is affected.
- ABA Formal Opinion 512. Addresses generative AI tools and the confidentiality questions they raise.
Clients are asking too. Corporate clients and insurers increasingly send security questionnaires before they hire or renew a firm. Being able to answer them honestly is now part of winning work.
Five Safeguards Every Firm Should Have
- Multifactor authentication everywhere. Email, document management, practice management, remote access and banking. A stolen password alone should never be enough to get in.
- A wire verification rule with no exceptions. Any change to payment instructions is confirmed by phone, using a number you already have on file, never one from the email. Tell clients about this rule at engagement so they expect it.
- Backups you have actually restored. Keep copies of files and email that ransomware cannot reach, and test a restore on a schedule. A backup you have never restored is a hope, not a plan.
- Phishing training with practice. Short, regular training and simulated phishing emails build the habit of pausing before clicking. Attorneys and staff both need it.
- A written incident response plan. Who to call, how to preserve evidence, how to reach your insurer, and how you will meet your notification duties. Deciding this before a breach is far easier than during one.
What Good Protection Looks Like Day to Day
Good security at a firm should feel quiet. Updates install on their own. Suspicious sign ins are flagged and blocked. Departing employees lose access the day they leave. Someone reviews alerts every day, not just after something breaks. And when an attorney travels or works from home, the same protections follow them.
It also means knowing what you have: which systems hold client data, who can reach them, and which vendors connect to them. That inventory is the starting point for every security questionnaire, insurance application and ethics conversation.
Frequently Asked Questions
Are Small Firms Really at Risk?
Yes. Most attacks are automated and opportunistic. A solo or small firm with weak passwords or unpatched systems is easier to break into than a large firm, and the data inside is just as valuable.
Does Cyber Insurance Cover This?
It can help, but insurers now expect controls like multifactor authentication, tested backups and endpoint protection before they will write or renew a policy. Missing controls can mean higher premiums or a denied claim.
Where Should a Firm Start?
Start with an honest look at what an attacker can already see. Our free live security scan takes about ten minutes and shows your firm's outside exposure. From there, the safeguards above cover most of the risk.
How PC Techware Helps Law Firms
We have supported businesses in the Augusta area since 2001, and law firms are one of the industries we know best. We handle the technology, the security monitoring and the paperwork that clients and insurers ask for, so attorneys can focus on their cases. See how we work with firms on our law firm IT page, read our guide to preventing data breaches at Augusta law firms, or talk to us.
Sources
- ABA Model Rules of Professional Conduct
- ABA Formal Opinions 477R (2017), 483 (2018) and 512 (2024)
- FBI Internet Crime Complaint Center Annual Reports
Matt runs operations at PC Techware and works with clients every day on how technology supports their business.
Connect on LinkedIn
