IT and cybersecurity for law firms
For a law firm, a data breach is a professional responsibility matter.
Client confidences sit in firm mailboxes, the document management system, and the cloud services connected to them. Settlement proceeds and trust funds pass through that same technology. A failure there raises three issues at once: notice to clients, potential malpractice claims, and your obligations to the bar.
30 minutes. A strategic conversation. Clear next steps.
Your obligations continue while the technology is broken
People who attack law firms are after one of two prizes. The first is the confidential material held in mailboxes and document systems. The second is cash in transit: closing funds, settlement payments, and trust disbursements.
Business email compromise is the usual route to either prize. No advanced hacking is needed. A believable message, a lookalike domain, or a hijacked mailbox is enough when a busy person treats the request as ordinary.
The duty to safeguard client information contains no grace period for unfinished security projects. A firm faces the incident and the obligation simultaneously.
Business email compromise is the usual route to either prize. No advanced hacking is needed. A believable message, a lookalike domain, or a hijacked mailbox is enough when a busy person treats the request as ordinary.
The duty to safeguard client information contains no grace period for unfinished security projects. A firm faces the incident and the obligation simultaneously.
Where client confidences and client money are exposed
Firm email
More confidential material and more client money are lost through email than through any other channel. One hijacked partner mailbox or one lookalike domain can redirect a payment or leak a file, and the firm may learn of it days later.
Document management
Pleadings, agreements, discovery, and client correspondence are stored here. When too many people can open too many matters, the firm has a standing risk that produces no warning signs.
Devices, co-counsel, and backups
Lawyers' own phones and notebooks, outside counsel and vendors on shared matters, and backup copies all hold the same confidential material, and much of it sits beyond the firm's direct supervision.
Trust accounts and wires
Closings, settlements, and disbursements run through IOLTA and other trust accounts. They are large and deadline-driven, which is why forged wire instructions target them.
Warning signs inside a law firm
Wiring details for a closing or settlement are verified only by replying to the email.
No one has reviewed document system permissions since installation.
Lawyers use their own phones and notebooks, and the firm manages none of them.
Co-counsel and vendors can still open matters that ended long ago.
A few systems demand MFA, the rest do not, and the list is unknown.
The last cyber insurance form contained questions the firm answered by estimate.
Common Questions
Most states follow the ABA Model Rules. Rule 1.6(c) calls for reasonable efforts to prevent unauthorized access to or disclosure of client information. Comment 8 to Rule 1.1 extends the duty of competence to the benefits and risks of relevant technology. ABA Formal Opinion 483 addresses a lawyer's duties after a breach, including notice to current clients. Your own state's rules and breach statutes control, so confirm the specifics with your bar. Droptine supplies the technical safeguards and records that support those duties. We do not give legal advice.
Yes—attackers routinely target boutique and mid-sized law firms because they hold high-value trade secrets, M&A data, and trust account funds, but often lack the enterprise-grade security of large law firms.
General IT keeps your legal software updated and printers working, but specialized cybersecurity defends your practice against targeted phishing, client privilege breaches, and regulatory compliance issues that standard IT support isn't built to handle.
The vendor protects its own application: the sign-in, the hosting, and the code. Firm email, lawyers' personal devices, and outside parties with access to a matter are beyond its reach, and that unguarded territory is where trouble usually begins.
You promised clients confidentiality. Confirm your technology can deliver it.
Clients bring you matters they would share with no one else. Spend 30 minutes with us and learn whether the firm's systems are equal to that confidence.