Why Attorneys Can’t Ignore Cybersecurity Risk
- Hector R. Lopez
- Apr 14
- 3 min read
Law firms handle some of the most sensitive data in the economy — yet few attorneys treat the growing cybersecurity risk for attorneys as a professional obligation.
Law Firms Aren’t Licensed — Attorneys Are
The distinction matters more than most lawyers realize: your firm isn’t licensed to practice law — you are.
That means your duty to preserve confidentiality, integrity, and availability (CIA) of client information isn’t something you can outsource to IT or operations. It follows you personally, regardless of your firm’s structure, platform, or size.
The American Bar Association’s Model Rules of Professional Conduct make this obligation explicit:
Rule 1.6(c): A lawyer must “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”
Rule 1.1 Comment 8: A lawyer’s duty of competence includes understanding “the benefits and risks associated with relevant technology.”
The ABA has gone further in Formal Opinion 483, clarifying that lawyers must implement, monitor, and respond to cybersecurity incidents as part of their professional duties.
If your name is on the door? You’re not just a leader — you’re a named fiduciary. Regulators and courts increasingly view attorneys, not just firms, as individually accountable for governance failures.
Why Cybersecurity Risk for Attorneys Is Rising
Cybercriminals aren’t targeting law firms by accident — they’re targeting them because of the sensitive data attorneys manage and the relatively weak defenses many firms maintain.
Litigation strategies, M&A deal terms, regulatory disclosures — gold mines for espionage and extortion.
Personally identifiable information (PII) — Social Security numbers, financials, health records — ideal for identity theft and fraud.
Attorney-client privilege files — leaks that can derail cases, bankrupt companies, or expose whistleblowers.
As the ABA Cybersecurity Handbook (3rd Edition) bluntly notes: “Law firms are data-rich and defense-light — making them prime targets for attackers who want maximum leverage with minimum effort.”
If You Haven’t Reviewed Your SaaS Stack, You May Already Be in Breach
Most firms adopt off-the-shelf SaaS tools — cloud storage, e-discovery, conferencing, legaltech — without legal review of where data resides, how it’s encrypted, or what happens in a breach.
Using platforms like:
Google Workspace or Dropbox without enforced MFA or DLP
Zoom or Slack without disabling risky integrations
DocuSign or Clio without enforceable SLAs
…could put you in continuous violation of ethical duties.
Worse, many tools store data in third countries or rely on subprocessors clients never consented to. Without formal cybersecurity reviews and SLAs, most firms are one convenience click away from a governance crisis.
👉 BravoCheck models this same governance rigor in our own Privacy Notice, ensuring every engagement rests on enforceable data protections.
Real-World Consequences: Breaches That Cost Millions
The risks aren’t hypothetical. Recent law firm breaches prove that weak cyber governance triggers real liability.
In 2023, Orrick, Herrington & Sutcliffe disclosed a breach affecting 638,000 individuals tied to major clients. By 2024, the firm agreed to an $8M settlement to resolve class-action claims. (Reuters coverage)
Gunster faced similar fallout, agreeing to an $8.5M settlement after ransomware disrupted operations and exposed PII.
Bryan Cave Leighton Paisner (BCLP) saw reputational damage after third-party MOVEit compromise exposed client data.
The message is clear: courts, regulators, and clients will no longer accept “we trusted our IT vendor” as a defense.
Attorney Cybersecurity Obligations Are Governance Duties
At BravoCheck, we’ve seen this pattern across every regulated sector: when governance and operations misalign, risk festers — until it’s too late.
For law firms, attorney cybersecurity obligations are not abstract ethics — they are personal fiduciary responsibilities. Meeting them requires:
Defensible vendor review processes for every SaaS platform.
Written SLAs for all tools touching client data.
Documented risk appetite & response thresholds.
Attorney education on obligations that cannot be outsourced.
This is governance, not IT. Failure to act isn’t delegation — it’s abdication.
The BravoCheck Perspective
Cybersecurity is now a core competency of modern legal practice. Whether you are a managing partner, solo attorney, or general counsel, your data governance decisions are ethical obligations.
At BravoCheck, we help firms meet attorney cybersecurity obligations with JD-led, CISSP-certified, ANSI-accredited, and DoD-approved credentials, 20+ years of boardroom governance expertise.
When attorneys take ownership of cyber governance, they don’t just reduce risk — they build trust, credibility, and resilience.
It’s time to treat data protection not as a checkbox, but as a professional and fiduciary duty.👉 Explore BravoCheck’s Governance Services
It’s time to treat data protection not as a checkbox, but as a professional and fiduciary duty.
Comments