Law firm cybersecurity: how small and mid-size firms protect client data

Small and mid-size law firms protect client data best by controlling access at the matter level, hardening email against fraud, keeping backups that ransomware cannot reach, and being able to prove all of it when a client asks. A law firm’s product is confidential information and judgment about it, so a breach puts client relationships and professional obligations at risk along with the systems themselves. None of the controls below require an enterprise budget. They do require deliberate decisions about who can see what.

Why are law firms such attractive targets?

Firms hold exactly what attackers want: privileged communications, deal terms before they are public, personal and financial records, and, in transactional practices, instructions for moving large sums of money. Smaller firms also tend to run lean on IT, with a shared administrator account here and an unpatched server there.

The financial exposure is real across industries. The IBM Cost of a Data Breach Report 2026 puts the global average cost of a data breach at USD 4.99 million, a 12% increase over the prior year and a record high. For a firm, the harder costs to measure are the client who quietly moves work elsewhere and the time partners spend on notification instead of practice.

Control access at the matter level

In most environments we review, document access is organized around convenience: everyone can open the shared drive, and the document management system inherits broad permissions from years ago. That works until an account is compromised or a conflict wall is needed.

• Structure permissions by matter and practice group, not by “all staff.” A paralegal on one litigation team should not have default access to another team’s M&A files.
• Use ethical walls in the document management system and confirm they are enforced in the underlying storage, not just in the interface.
• Review access when people change roles or leave. Departing attorneys and staff should lose access the same day.
• Remove standing administrator rights from daily-use accounts. Administrators sign in with separate, MFA-protected accounts when they need elevated access.
• Turn on audit logging for document access so the firm can answer “who opened this file?” after the fact.

Harden the document management system and endpoints

The document management system is the firm’s vault. Treat it that way:

• Require MFA for every user, including remote and mobile access.
• Encrypt laptops and mobile devices, and manage them centrally so a lost device can be wiped.
• Patch the document management system and its integrations on a schedule. The Verizon 2026 Data Breach Investigations Report found that 31% of breaches now start with software vulnerabilities, “beating stolen passwords as the top way attackers get in.”
• Restrict external sharing links and set them to expire.

Close the email gap, especially on real-estate closings

Email is where much of a law firm’s risk concentrates. Business email compromise (BEC) losses reported to the FBI were about $3.05 billion in 2025, according to the FBI IC3 2025 Internet Crime Report, and the report tracks BEC incidents involving real estate transactions as their own category (“BEC/Real Estate”). Firms that handle closings, escrow, or settlement funds sit directly in that path.

The common pattern: an attacker gains access to a mailbox at the firm, the title company, or the client, watches the transaction, and sends altered wiring instructions shortly before closing. The defenses are a mix of technology and procedure:

• Phishing-resistant MFA for attorneys and staff who handle funds.
• Alerts on new mailbox forwarding rules and unusual sign-ins.
• DMARC enforcement on the firm’s domain, plus detection of lookalike domains.
• A written rule, communicated to clients at engagement, that the firm will never change wiring instructions by email, and a phone callback to a known number before any funds move.

Keep backups that ransomware cannot reach

The same Verizon report found that 48% of all breaches now involve ransomware, “but payouts are shrinking.” For a firm, the realistic recovery plan is to restore, not to pay. CISA’s #StopRansomware Guide recommends that organizations “maintain offline, encrypted backups of critical data” and “regularly test the availability and integrity of backups in a disaster recovery scenario.” It also advises maintaining “golden images” of critical systems and retaining backup hardware to rebuild.

In practice that means the document management system, email, and accounting data are backed up to a location an attacker with domain administrator rights cannot delete, and that someone actually restores a matter folder on a schedule to prove it works. Cloud email and file platforms need their own backup; the provider’s retention settings are not a substitute.

Be ready for outside-counsel security questionnaires

Many corporate clients send outside-counsel guidelines and security questionnaires before engaging a firm or renewing a panel. Expect questions about MFA, encryption, endpoint protection, backups, incident response, vendor management, and staff training. Vague answers slow down engagements; inaccurate ones create risk later.

Keep a current evidence library: policies, configuration screenshots, training records, and a written incident response plan. Our guide to building an incident response plan is a reasonable starting point.

On professional obligations, ABA ethics opinions address lawyers’ duties around securing client communications, and state bars issue their own guidance. Read the relevant opinions and your state bar’s guidance with your firm’s ethics counsel; this post is operational guidance, not legal advice.

How Intelligent Group can help

Intelligent Group supports professional services firms, including law practices, with the controls above: matter-level access design, MFA rollout, device management, and documentation clients ask to see. Our email security work targets the BEC patterns behind closing fraud, and our backup and disaster recovery service keeps restorable copies outside an attacker’s reach. You can see the other sectors we support on our industries page.

Frequently asked questions

What is the single most important security control for a small law firm?

Multi-factor authentication on email and the document management system, ideally phishing-resistant for attorneys and staff who handle funds. Account takeovers commonly begin with a stolen password, and MFA closes that path. Pair it with a callback rule for any change to wiring instructions.

Do we need separate backups if our documents are in the cloud?

Yes. Cloud platforms keep your data available, but deletion, ransomware encryption of synced files, or a compromised administrator account can still remove it. An independent, tested backup gives you a copy that does not depend on the same account or provider.

How should we answer a client’s security questionnaire honestly?

Answer what is true today and say clearly what is in progress, with a date. Attach evidence where you can. Overstating a control is worse than admitting a gap, because the client will rely on your answer.

Is this guidance enough to satisfy our ethical obligations?

No. Operational controls support your obligations but do not define them. Review the applicable ABA ethics opinions and your state bar’s guidance with counsel.