The Legal Brief, issue 2, October 2026.
Could you tell a client today exactly who at your firm can open their file? If you hesitated, you have a law firm data security gap that nobody has written down yet, and that gap is the first thing a client, a carrier, or a regulator will ask about if something goes wrong.
“We trust our people” is not a control. It is a hope, and hopes do not hold up in an audit or a deposition.
Why does a vendor breach become your firm’s problem?
Japan’s National Police Agency learned this the hard way this month. A breach at cloud provider Arcadia potentially exposed records on 125,000 officers, and the agency’s own systems were not the point of failure. A vendor holding their data was.
The lesson scales down fine. Your confidentiality promise to a client is only as good as the weakest vendor or shared drive sitting behind it. A cloud backup provider, a document management host, even a copier with remote diagnostics, each one is a door into your clients’ files. If you cannot name every vendor touching your data, you cannot honestly promise confidentiality, no matter how careful your own staff is. For a firm with a handful of partners and one outside IT contact, that list is usually shorter than you think, but almost nobody has written it down.
Are law firms actually being targeted by ransomware?
Yes, and not just the big names. This month alone, three separate ransomware groups published new law firm victims. The N0n group hit a family law firm, where custody records and settlement details are exactly what these crews go looking for. Everest published Linebarger Goggan Blair & Sampson, a government receivables firm, a reminder that firms holding government client data are targets twice over. And Incransom listed bereskinparr.com and smartbiggar.ca, an intellectual property practice.
None of these were national firms with hundreds of attorneys. Ransomware crews do not check headcount before they publish a victim list. They check for an open door. A firm this size rarely has a security operations team watching for that door at 2 a.m., which is exactly why the access list matters more than the firewall.
Why do privacy promises carry legal weight for small firms?
Meta was just ordered to pay New Mexico $25 billion for deceiving users about privacy on Facebook. Your firm is nowhere near that size, but the principle is the same one a judge or a bar complaint committee will apply to you: a privacy promise you cannot back up with a control is a promise you broke, whether you meant to or not.
It cuts both ways for firms doing the litigating too. Edelson Lechtzin LLP is investigating class action claims tied to a Computer Task Group breach that exposed Social Security numbers and health data. Picture a plaintiff’s firm building a case file on exactly that kind of breach. That firm now holds the same category of sensitive data on its own servers, under the same confidentiality promise it is suing someone else for breaking. Your file security is not separate from the case. It is part of it.
What is the one law firm data security question that matters?
Could you tell a client today exactly who at your firm can open their file? If the honest answer is probably most of the office, you have a confidentiality gap nobody has written down. Knowing who can open what, and being able to show it inside five minutes rather than five days, is dull work. It is also the work that holds up when a carrier, a client, or opposing counsel finally asks.
What should your firm do before the end of the month?
A short plan, not a project:
- List every folder or system holding client files, and write down who has access to each one.
- Cut access for anyone who does not need it for their current role. Most firms find that is more people than expected.
- Keep that list somewhere you can hand it to an auditor, a carrier, or a client in five minutes.
Start with the basics if two factor authentication is not already firm-wide: a short 2FA setup guide covers the first hour of that work.
TC³ can map who has access to what across your systems and tighten it down to what people actually need. We will not write your retention policy or represent you if a regulator calls, that is your counsel’s job, but we can make sure the technical side of “who can see this” has an honest answer. See how this fits firms like yours on TC³’s legal industry page, and browse past regulatory updates on the compliance and regulatory updates hub.
Read past issues in The Legal Brief archive, and if this landed in front of you secondhand, subscribe to get the next one directly.
Researched and drafted with AI, then reviewed and approved by Ron Trotto before publishing.