Law Firm Data Breaches and Legal Malpractice Risks

A 2015 report issued by Citigroup’s Cyber Intelligence Center warns that law firms are at high risk for data breaches. Law firms are virtual warehouses of confidential client, employee and third-party data, such as discovery and details on client and third-party mergers and acquisitions, patent applications, and financial transactions. However, law firm data security measures are frequently substandard.

A data breach can come from inside or outside the firm. Whether due to a cyber attack, employee or sub-contractor theft or negligence, or the theft or loss of a laptop, thumb drive or mobile device containing client information, such data breaches can expose attorneys and law firms to legal malpractice claims.

The ABA Model Rules of Professional Conduct require that attorneys protect client data and prevent unauthorized disclosure of client information. A patchwork of federal and state laws establish liability for data breaches and govern security requirements, notification and more.

Counsel representing attorneys or law firms victimized by a data breach must be prepared to respond rapidly to assess and mitigate potential damages, leverage insurance coverage and risk management, navigate multiple government agencies’ and litigation-related investigations, and defend potential legal malpractice claims.

Listen as our authoritative panel prepares counsel to defend law firms facing professional liability claims after suffering data breaches. The panel will discuss risk assessment and mitigation, outline the steps a law firm must take to protect its interests and clients once a breach has occurred, and provide strategies for navigating investigations and defending against professional liability claims.

1. Data breach risk assessment overview
2. Responding to a breach
   1. Notification obligations to employees, customers, vendors, government
   2. Federal and state law regulations and legislation
3. Representing attorneys and law firms in investigations and litigation
   1. Individual and class claims
   2. Defenses
   3. Parallel investigations
   4. Settlements
4. Risk management and insurance coverage

The panel will review these and other key issues:

• How should law firms respond to parallel government investigations of data breaches?
• What insurance coverage may be available to cover privacy and data breaches and how can law firms maximize existing insurance coverage?
• What strategies can help counsel defend claims against law firms arising from data breaches?
• How can law firms limit exposure to cyber attacks and other data breaches?