Attorney-client privilege is one of the oldest protections in the profession and one of the easiest to undermine without anyone at the firm noticing. A privileged email forwarded to a personal account. A client file synced to an unmanaged home laptop. A paralegal’s phone with firm email and no passcode. None of that looks like a security incident until the day it becomes one.
The duty itself hasn’t changed. What changed is where client information lives. A decade ago, confidentiality mostly meant locked file rooms and careful conversations. Now it means cloud document management, e-discovery platforms, video depositions, e-filing portals, and a steady stream of attachments moving between attorneys, clients, experts and opposing counsel. The firm’s obligation follows the data everywhere it goes, including places the IT setup was never designed to reach.
The Numbers Law Firms Don’t Love Talking About
About 29 percent of law firms have reported a data breach at some point, according to the American Bar Association’s TechReport survey. A more recent Arctic Wolf survey found 39 percent had a breach in just the past year, climbing to 42 percent among firms with 100 or more staff. Among breached firms, 56 percent confirmed client data was actually lost or exposed, not merely accessed. The average ransom demand against legal organizations reached roughly $1 million in a recent year, and professional services ransom payments have averaged more than $500,000 (figures compiled by DeepStrike’s law firm data breach research).
Firms are a particular kind of attractive target. They hold concentrated, high-value information on behalf of clients: merger terms, litigation strategy, medical and financial records produced in discovery, settlement figures. Those clients agreed to trust the firm’s judgment, not to inspect its security. When a breach happens, it isn’t only the firm’s problem. It’s a breach of someone else’s confidential matter, with malpractice exposure, bar complaints and very uncomfortable client conversations attached.
The Ethics Rules Already Expect This
Many lawyers still think of cybersecurity as an IT concern rather than a professional responsibility issue. The ABA Model Rules suggest otherwise. The duty of competence includes understanding the benefits and risks of relevant technology, and the confidentiality rule calls for reasonable efforts to prevent unauthorized access to client information. Most states, Massachusetts included, have adopted versions of both.
“Reasonable efforts” is a flexible standard, and that cuts both ways. A firm isn’t expected to run a Pentagon-grade security program. It is expected to have thought about the risks that come with how it practices and to have taken sensible steps to address them. If an incident ever lands in front of a bar examiner or a malpractice carrier, the question won’t be whether the firm was perfect. It will be whether the firm did what a careful practice should have done.
Where Firms Actually Get Exposed
It’s rarely a sophisticated attack. It’s a partner’s personal phone with firm email and no ability to wipe it remotely. It’s a paralegal who can open every matter in the document system instead of only the ones they’re staffed on. It’s e-discovery data sitting behind an unrestricted file-sharing link because the production deadline was tight and nobody looped in IT.
Consider a common scenario. A firm settles a case and the client’s file includes sensitive medical records. Two years later, an associate who worked the matter leaves for another firm. Their account is disabled, but a sharing link they created to send records to an expert witness was never revoked. Anyone with that link can still open the folder. Nobody at the firm knows it exists, and nothing will flag it until someone stumbles across it, possibly the wrong someone.
Email is the other major weak spot. Wire fraud aimed at real estate closings and settlement disbursements remains one of the most damaging threats firms face. An attacker who gets into one attorney’s mailbox can watch a closing approach and send altered wire instructions at exactly the right moment, from a real address, to a client who has every reason to trust it.
Practical Controls That Don’t Slow the Practice Down
Each of these gaps is fixable without making attorneys’ days harder, as long as someone is looking for them before a client audit or bar complaint does:
- Matter-level access controls, so staff see only the files their role and staffing require
- Mobile device management on every device that touches firm email, with the ability to remotely wipe firm data from a lost or stolen phone
- Secure, audited file sharing for discovery and client exchanges, with links that expire, instead of ad hoc email attachments
- Multi-factor authentication on email and practice management systems, which is where most incidents start
- A written wire verification protocol shared with clients at engagement, stating that the firm will never change payment instructions by email
- An offboarding checklist that covers sharing links, mobile devices and third-party portals, not just the main login
Client Security Questionnaires Are Coming
Corporate clients, insurers and financial institutions increasingly send outside counsel security questionnaires before engagement or at renewal. They want to know whether the firm uses MFA, encrypts devices, trains staff and has an incident response plan. Firms that can answer confidently win and keep that work. Firms that can’t are finding the conversation shifts from legal expertise to risk, and that’s not a conversation any partner wants to have with a general counsel.
Law Firm Cybersecurity Questions
Are law firms required to protect client data with technology?
The ABA Model Rules call for technology competence and reasonable efforts to prevent unauthorized access to client information, and most states, Massachusetts included, have adopted similar rules.
How do most law firm breaches start?
Usually through email: phishing, stolen passwords or compromised accounts, rather than sophisticated hacking. Multi-factor authentication on email closes much of that risk.
How can law firms prevent wire fraud?
Tell clients at engagement that the firm will never change payment instructions by email, and verify any change by phone using a known number.
The Takeaway
Client confidentiality is now as much a technology question as a professional one. The firms that stay out of trouble aren’t the ones with the most expensive tools. They’re the ones that know who can see each matter, can lock down a lost device in minutes, and have made wire fraud nearly impossible through a simple, published verification rule. Start with one question you should be able to answer for every file in your system: who can see this, and should they?
Cloud9 Tech Solutions works with Massachusetts firms to build these protections into everyday practice rather than a once-a-year audit response, through IT support designed around how law firms actually handle matters, backed by the same security stack we build for every regulated client.
If you’re not confident you could answer “who can see this matter” for every file in your system, that’s worth finding out before a client or a bar examiner asks first. Schedule a free security assessment with Cloud9.