The Legal Brief, Issue 1, September 2026
A law firm data breach rarely starts with a sophisticated attacker. It starts with a public facing form nobody double checked, and an access list nobody wrote down. Hackers claim they pulled sensitive employee data off the FBI’s own jobs site this month. If the FBI can leave a form exposed, the honest question for your office is simpler: do you know who can open your client files right now, or is the answer probably most of the office?
Doing nothing about that question has a real cost, not a vague one. Most states start the breach notification clock the moment personal data walks out the door, and “we trust our people” is not a control you can describe to an insurance carrier after the fact. Knowing who can open what, and being able to show it on paper, is dull work. It is also the exact work that holds up when a client, or an auditor, finally asks.
Could a law firm data breach happen the way the FBI’s did?
The FBI is investigating hackers’ claim that they stole sensitive employee data through its jobs website, and the case is still open. The lesson here is not about the FBI’s budget, which dwarfs any small firm’s. The lesson is that even a well funded organization can leave one public facing form thinner than everything behind it. Your firm has its own version of that form: an intake portal, a client upload link, a vendor login nobody has reviewed since it was set up. What it means for a firm this size: your weakest entry point is worth checking this month, not assuming it is fine because nothing has gone wrong yet.
What does a data breach settlement actually cost a firm like yours?
Numbers help here more than warnings do. The Modernizing Medicine data breach settlement closed at $2.99 million, a figure that lands well past the cost of simply knowing your access list before a breach happens. Settlements like that come after legal fees, notification costs, and the hours your own staff spends answering for a decision nobody documented. What it means for a firm this size: the cost of prevention, an afternoon spent listing who can open what, is a rounding error next to the cost of cleanup.
Why does the breach notification clock matter to your firm?
Once personal data leaves your systems, most states give you a fixed window to notify everyone affected, often measured in days rather than months. That clock starts whether or not you were ready for it. A firm that can produce an access list and show who could have touched the data meets that deadline with facts. A firm that cannot is left explaining “we trust our people” to a client, a bar association, or a carrier, none of whom will accept it as an answer. What it means for a firm this size: the notification clock does not wait for you to build the paperwork, so the paperwork has to exist before the breach, not after.
What’s the one control most firms haven’t written down?
Could you tell a client today exactly who at your firm can open their file? If the honest answer is probably most of the office, you have a confidentiality gap nobody has written down yet. “We trust our people” is not a control you can describe to a carrier, a client, or an auditor. Knowing who can open what, and being able to show it, is the dull work that holds up when somebody finally asks. It is the one thing every firm in this issue’s news items was missing before the headline hit.
What should your firm do this week?
- List every system that touches client or employee data, and write down, honestly, who can open it right now.
- Compare that list to who actually needs access to do the job, then cut the rest.
- Keep that list somewhere you can hand to a client or a carrier without scrambling to build it after they ask.
None of this requires new software. It requires an afternoon and the willingness to write down an answer you might not like.
TC³ does not run the FBI’s security, and we cannot promise your firm will never make headlines. What we do is help you build and keep the access list above, the kind of documented control that actually answers a client’s question instead of dodging it. For more on the compliance side of this work, visit our compliance and regulatory updates hub or the legal industry page built for firms like yours. Past issues of this brief live in the Legal Brief archive. If this landed in your inbox from someone else, subscribe here to get the next one directly.
Ron
PS. The FBI investigating its own jobs page is a plot twist even a network admin has to appreciate.
Researched and drafted with AI. Published before TC3 added human review in October 2026; questions go to a human at [email protected].