The legal profession has spent this year learning an uncomfortable lesson about the value of the information it holds. Over the past several months, breaches have been disclosed by several of the most recognizable names in American law, including Greenberg Traurig, Eckert Seamans, Quinn Emanuel, and McDermott Will & Schulte. In the Greenberg Traurig incident, client documents were accessed by an unauthorized actor and posted to the dark web, while Eckert Seamans was met with proposed class actions after birth dates and Social Security numbers were exposed. According to reporting by Reuters, one prominent digital risk practice responded to nearly sixty law firm incidents last year, nearly double the prior year's figure. Whatever comfort was once taken from the assumption that only the largest targets attract attention is no longer supported by the evidence.
What deserves particular attention is the method by which these incidents were carried out. In case after case, perimeter defenses were not defeated by sophisticated exploits. Instead, individual attorneys and staff members were manipulated through social engineering into granting access that no firewall would have blocked. A single convincing message was enough to expose client files at firms with substantial budgets. Having supported legal practices for the better part of two decades, I have watched this pattern repeat with discouraging regularity, and the firms that fare best are rarely the ones with the most elaborate tools. They are the ones whose people have been taught to pause.
Why the Stakes Are Higher for Law Firms
Law firms occupy an unusual position in the economy. Client identities, litigation strategies, merger terms, and personal records are concentrated in one place, and the damage from exposure extends far beyond the cost of remediation. The American Bar Association's Model Rule 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized disclosure of client information, a standard increasingly interpreted to include technical safeguards, risk assessment, and incident response planning. According to the ABA's Cybersecurity TechReport, roughly twenty-nine percent of firms have experienced a breach, with the highest incident rates reported by firms of ten to forty-nine attorneys. Ethics complaints, malpractice claims, and reputational harm are now treated as predictable consequences of inadequate controls.
What a Reasonable Defense Looks Like Today
Although the headlines have involved large firms, smaller practices are considered softer targets precisely because weaker defenses and busier staff are assumed. The measures that matter most are unglamorous. Phishing-resistant multi-factor authentication should be required for every account, a position that has only grown stronger as text-message verification has been phased out by major vendors. Attorney and staff training should be refreshed regularly, because social engineering succeeds where suspicion has been allowed to lapse. Access to client files should be limited to those who genuinely need them, and vendors that touch firm data should be reviewed with the same rigor as the firm's own systems. These themes were explored in our earlier piece on cybersecurity controls for law firms, and the fundamentals described there have not changed.
Preparation for the bad day deserves equal weight. When a breach occurs, the first hours determine whether the incident is contained or compounded, and a written response plan is worth more than any product purchased afterward. Decisions about notification, forensics, and client communication should be made calmly in advance rather than improvised under pressure. In our experience with firms ranging from two attorneys to fifty, those that recover most gracefully considered the question of response long before an attacker gave them a reason to. Firms uncertain about where they stand can begin with a security review, the same starting point we recommend to any organization that handles sensitive records, as discussed in our guide to IT support for law firms.
The wave of incidents now moving through the legal industry should not be read as a reason for panic, but as a reason for honesty. Client confidentiality has always been the foundation of the profession, and the modern version of that obligation is written in firewalls, authentication prompts, and trained staff as much as in engagement letters. The firms that accept this will continue to be trusted with the work. Those that do not will eventually be asked why.
