11.03.01. Cybersecurity

Today the question is not if a law firm will be impacted by a cybersecurity threat (hacking, ransomware, phishing, etc.).  The attack could be using a password to gain access to your files, viruses which become embedded in your system and are used to corrupt the system, steal the data, or to spread malware.  All of these things can put client confidential information at risk; therefore, it is important for lawyers to have a plan to make their systems less vulnerable and  a plan to respond to an attack when it occurs.[1]  The first thing that the firm should do is evaluate their insurance policies to see if they cover cybersecurity breaches (and if not consider obtaining a policy that covers cybersecurity disruption).  The firm should also have a response plan in place (and everyone in the firm should know about it).  The plan may vary by size of firm, but at the least have a clear protocol for who will be responsible for each step of the process:  getting the computers back (or locating backup information if the computers are down) so clients are not harmed; contacting outside experts (if necessary) to assist in restoring the computers. 

     The next step is determining what information was compromised to see if you need to contact current or former clients that there was a breach and what the extent of the breach was.  It should be noted that the ABA issued a formal (483) holding that the ABA Rule does not require lawyers to inform former clients because there is no black letter requirement in the rule.  There may also be state laws that require disclosure to individuals whose information was affected.  Lawyers should also keep clients informed as the remediation process takes place.  In addition, lawyers should also notify their insurance carrier.

[1] These three steps are set out in Peter C. Buckley & Caroline A. Morgan, “Three Key Actions Attorneys Should Take After a Data Breach,”