Washington Lawyer - November/December 2024 - 22

FEATURE
YEAR-END CHECK-IN
DATA
BREACH
READINESS
By Ilia Kolochenko
T
he end of the year is an opportunity to take
stock of your firm's accomplishments and areas
of growth, but it is also a time to assess its challenges
and vulnerabilities, including exposure
to cyber threats, to future-proof your business.
As we head into the new year, ask yourself: Is your small law firm the target
of hackers? The simple answer is yes. The internet is replete with sensational
blog posts by cybersecurity vendors vigorously chasing and
competing for new clients by naming and shaming large law firms that
have been breached, but the truth is that organized cybercriminals silently
but increasingly focus their efforts on breaking into both large and
small law firms to steal their sensitive data.
Firms with resources to pay a generous ransom to avoid having their clients'
sensitive data exposed on the Dark Web are attractive targets, with
hackers demanding an average of $1 million to $2 million in exchange for
the stolen data. However, even smaller legal practices, including boutique
firms and solo practices, may be in the crosshairs of cybercriminals
who want valuable client secrets.
RISK ON THE RISE
Back in 2019, William Evanina, then-director of the U.S. National Counterintelligence
and Security Center, warned about large-scale hacking campaigns
by cyber mercenaries and state-sponsored hacking groups to
break into U.S. law firms.
" You're a one-stop shop for hackers, whether they're criminals, hacktivists,
or foreign spies. You keep intellectual property, sensitive merger and
acquisition details, and confidential personal data on many clients, " Evan22
WASHINGTON LAWYER
* NOVEMBER/DECEMBER 2024
ina said in remarks before the International Legal Technology Association.
" Targeting you is an efficient way to access data on many organizations,
instead of targeting each directly. "
The danger to law firms has only grown over the years. According to the
American Bar Association's (ABA) 2023 Legal Technology Survey Report, 29
percent of respondents said their law firm had experienced a security
breach. According to Law.com, 21 law firms have reported data breaches
as of May, indicating that 2024 is on pace to become the biggest year in
the history of law firm breaches.
The alarming trend is even bigger on the other side of the Atlantic. The
Law Society in England reported in 2022 that a stunning 65 percent of
English law firms have fallen victim to a cyber incident. The numbers reflect
a 2023 statement from the UK National Cyber Security Centre saying
that hackers-for-hire, or cyber mercenaries, are purposely going after law
firms to obtain trade secrets, confidential M&A information, financial
documents, and other sensitive client information.
At first glance, it may appear that some law firms are more susceptible to
cyberattacks than others because of their large size or specific practice
area. Large law firms have significantly more digital assets and trusted
third parties with access to their confidential data, such as IT vendors,
consultants, and accountants. The larger an attack surface, the easier it
is to find the weakest link and compromise the entire ecosystem.
However, most of these factors are about assumptions and correlations
rather than causation. A solo practitioner defending a low-income plaintiff
in a pro bono case may also be raided by professional cyber mercenaries
hired by the wealthy defendant to gain an unfair advantage for
the settlement, get the complaint dismissed, initiate a SLAPP suit to silence
the media, or exert psychological pressure on the disadvantaged
and vulnerable plaintiff.
Illustrations: Getty Images/Moment
http://www.Law.com
Washington Lawyer - November/December 2024

Table of Contents for the Digital Edition of Washington Lawyer - November/December 2024
