For many lawyers, the idea of cybersecurity may seem like a scary or foreign concept, only to be considered by the law firm’s IT group. But cybersecurity issues can impact all lawyers—and cybersecurity breaches can happen to any law firm, regardless of size.

Cybersecurity breaches also come in many forms, from targeted attacks on a firm’s network, to phishing scams trying to obtain passwords, to simply stealing a lawyer’s laptop or smartphone to access a firm’s network.

According to the American Bar Association, in 2022, 27% of law firms fell victim to some form of cybersecurity breach. Any type of breach has the potential to be devastating for law firms and their clients, exposing both to potential financial losses or legal vulnerability.

In a world where cybersecurity threats continue to increase, there are steps that firms can consider to help protect themselves, their employees and their clients.

Having an Incident Response Plan Can Prevent Headaches

According to 2022 data, the average cost to an American company or firm of a data breach is $9.44 million. However, detecting a breach early—and having a quick response time—can mitigate and significantly reduce the costs associated with a breach.

Having an incident response plan in place before a cybersecurity event ever happens can help prepare the law firm, if it ever falls victim to a cybersecurity breach. By planning for these events ahead of time, it can reduce the risk of acting too quickly or in a reactionary way to a breach. Creating a plan provides an opportunity for the law firm to consider the real risks of a breach and the appropriate next steps, if a breach should occur.

An incident response plan can also designate an individual or a team that is responsible for responding to security breaches and communicating with employees of the firm. The response team can also review whether and to what extent incidents need to be reported to specific authorities.

The plan can include information to help jumpstart an internal investigation, such as the physical locations of the firm’s computer networks and servers and the type of information stored on them. That way, in the event of a breach, the law firm does not need to waste time trying to gather static information.

In drafting an incident response plan, law firms can consider working under the direction of their general counsel’s office or working with outside counsel. This can also help preserve evidence and potentially cloak the plan and process in privilege. The plan may also contemplate whether and how to involve law enforcement in a breach response, or whether the law firm’s attorneys have any applicable ethical obligations (depending on the type of breach and the type of information at issue).

Considering Client Confidences

Many law firms house highly confidential information relating to clients, such as sensitive business dealings, privileged communications and evidence in ongoing litigation or private financial data.

Depending on the type of law practiced, the firm may store personal identifying information for clients or class members (such as Social Security numbers, bank account information or health care information). Such information is typically subject to a strict duty by lawyers to maintain confidentiality under ABA Model Rule of Professional Conduct 1.6.

After a breach, an early step for many firms is to review whether any confidential client information may have been put at risk and whether there are any additional ethical obligations that arise from that breach. For example, some states require that certain notifications be sent out to clients when a law firm suffers a breach. The duties often vary by jurisdiction and type of information impacted, so reviewing the firm’s obligations is an important early step.

Should Outside Counsel Be Retained?

After suffering a cybersecurity breach, law firms may benefit from hiring outside counsel experienced in cybersecurity and malpractice defense issues to assist in developing a specific plan and investigating the breach.

Engaging outside counsel may be beneficial if the firm is later subject to claims arising from the breach, such as claims that the firm improperly responded to the breach itself or that it failed to adequately safeguard client data.

Purchasing Cyber Insurance

Most law firms appreciate the importance of having an adequate professional liability policy in place to help defray the costs of legal malpractice actions or other related claims or losses. Some professional liability policies may provide coverage if a law firm is sued for breaching its legal duties in safeguarding confidential information or in responding to a cybersecurity breach.

But a standard professional liability policy may not cover every loss or cost relating to a cybersecurity breach. Thus, a critical part of risk management in anticipation of a potential cybersecurity event is to consider whether the firm needs more coverage than what is afforded in the typical professional liability policy.

Certain cyber policies may provide additional coverage for the costs of notifying clients or authorities about a breach, coverage for ransom payments (such as when a hacker holds information hostage) and more. But it is important to read the firm’s existing policies to determine whether there are areas of uninsured risk.

If a firm elects to pursue additional cyber insurance, it is critical for the firm to be candid in its policy application. The application may ask several questions about the firm’s current practices to protect its network, what vendors have access to its network and other security-related questions.

Law firms can put their coverage at risk if they are not honest in completing their policy applications. Notably, filling out the application can also act as a risk assessment tool regarding the firm’s best practices and exposing potential weaknesses.

By being prepared for a potential breach, law firms can restore some balance and power to an uncertain situation.