The Privileged Target: Why Security Has Become a Firm's License to Compete

Every law firm is, in effect, a concentrated archive of its clients' most consequential secrets, merger blueprints, litigation strategy, trade secrets, health records, and privileged advice that competitors and adversaries would pay handsomely to read. That concentration is precisely what makes firms irresistible to ransomware crews, credential thieves, and opportunists hunting leverage. The uncomfortable truth of the current decade is that a firm's security posture has quietly become part of its professional competence, and increasingly, part of whether it wins the engagement at all.

The financial gravity of getting this wrong is no longer abstract. The global average cost of a data breach climbed to $4.88 million in 2024, a 10% jump and the steepest single-year rise since the pandemic, according to IBM's Cost of a Data Breach Report. For firms that store and move the kind of material legal practices handle, the question is no longer whether security matters, but whether it is treated as a discipline or a checkbox.

$4.88M

Global average breach cost, 2024

44%

Of breaches involved ransomware

36%

Of firms reported a security incident

60%

Of breaches involved a human element

Why the Legal Industry Sits in the Crosshairs

A single matter file can be a small fortune to the right buyer. It may carry personally identifiable information, discovery materials, employment records, settlement positions, intellectual property, and nonpublic deal terms, often bundled together in one place. When that material is encrypted or exfiltrated, the damage radiates far beyond a few days of downtime: confidentiality failures, regulatory notification duties, malpractice exposure, class-action litigation, and the slow erosion of client trust that no insurance policy fully restores.

Attackers have noticed. The 2025 Verizon Data Breach Investigations Report analyzed 22,052 security incidents and 12,195 confirmed breaches, and found ransomware present in 44% of breaches, up from 32% a year earlier, a 37% relative increase. The same report documents that third-party involvement in breaches doubled from 15% to 30% in a single year, a finding with direct implications for firms that lean heavily on cloud platforms, e-discovery vendors, and managed service providers.

The legal sector's own numbers echo the trend. The American Bar Association's 2024 TechReport found that roughly 36% of firms reported experiencing a security incident, a figure that has trended upward as firm-sized targets become more attractive, per analysis of the ABA Cybersecurity TechReport. And the human factor remains stubbornly central: about 60% of breaches still involve human error, social engineering, or misuse, according to Verizon's 2025 findings.

The Climbing Cost of a Breach

Global average total cost of a data breach, USD millions

Source: IBM Cost of a Data Breach Report 2024 and prior-year editions.

The Threat Landscape, Mapped

The way attackers get in is rarely glamorous. Verizon's breakdown of intrusion methods shows that the most common doors are also the most ordinary: ransomware as the leverage mechanism, stolen credentials as the entry key, and phishing as the lure that hands those keys over.

How attackers break in, share of breaches by method (2025 DBIR)
Method	Share of breaches	Why it works against firms
Ransomware	44%	Encrypts case files and threatens to publish privileged data
Stolen credentials	32%	Bypasses perimeter defenses with valid logins
Vulnerability exploitation	18%	Targets unpatched portals and edge devices
Phishing	14%	Exploits time-pressured staff and trusted senders
Backdoors	14%	Enables persistent, quiet access for later extortion

Figures from the 2025 Verizon DBIR summary; categories overlap, so shares do not sum to 100%.

Phishing and Business Email Compromise

The easiest path into a firm is usually a person, not a protocol. Convincing messages arrive dressed as courts, clients, opposing counsel, or a managing partner, aiming to harvest credentials, intercept multifactor codes, or reroute a wire. Generative AI has sharpened these attacks considerably, producing flawless prose, mimicking an executive's tone, and fabricating invoices at scale. The defensive posture must assume some users will click and limit what an attacker can do next, through phishing-resistant authentication, out-of-band verification for payment changes, and tightly scoped access.

Ransomware and Double Extortion

Ransomware is uniquely punishing for firms because the leverage is doubled: attackers can both lock systems and threaten to leak confidential material. The economics, however, are shifting. The median ransom payment fell to $115,000 in 2024 from $150,000 the prior year, and notably, 64% of victims refused to pay at all, up from 50% two years earlier, per the 2025 DBIR analysis. That refusal is partly a function of better preparation: immutable backups and tested restoration make negotiation optional rather than existential.

Ransomware's Rising Footprint, and Its Uneven Weight

Share of breaches involving ransomware, by year and by organization size

Source: Verizon 2025 DBIR. Small and mid-sized organizations are hit far harder than large enterprises.

The gap between firm sizes is stark. Ransomware appeared in 39% of breaches at large organizations but a staggering 88% of breaches at small and mid-sized businesses, a category that captures the majority of legal practices, according to BARR Advisory's reading of the DBIR. Smaller firms, in other words, face the highest concentration of the most disruptive threat with the thinnest defenses.

Third-Party and Supply-Chain Exposure

Modern practice runs on a constellation of vendors, and each one extends the firm's risk perimeter. A vendor compromise becomes a firm breach the moment that vendor can touch client data, which is why sophisticated clients now treat their outside counsel as part of their own supply chain and expect the same discipline applied downstream. With third-party involvement in breaches doubling year over year per the 2025 DBIR, vendor due diligence can no longer end at onboarding; it must be continuous, tiered by risk, and contractually enforced.

Security as an Ethical Duty, Not Just an IT Project

The professional rules that govern lawyers map cleanly onto cybersecurity. Competence, under ABA Model Rule 1.1, now explicitly extends to understanding the benefits and risks of relevant technology. Confidentiality, under Rule 1.6(c), demands reasonable efforts to prevent unauthorized disclosure, a standard that rises as threats and available safeguards evolve. Communication duties under Rule 1.4 can require timely client notice after a material incident, and supervision rules mean partners cannot simply delegate security to IT and look away.

That ethical framing has teeth. The settlements arriving on the docket make clear that breaches translate into real liability for firms of every size.

Recent law firm breach settlements and incidents
Firm / Event	Outcome	Significance
Orrick, Herrington & Sutcliffe	$8.0M settlement	Final approval; breach affected 600,000+ individuals
Gunster, Yoakley & Stewart	$8.5M settlement	Class resolution over exposed personal data
Kelley Drye & Warren	Class action filed (2025)	Litigation risk now routine after legal-sector breaches

Reporting via the ABA Journal and Reuters Legal.

Frameworks That Make a Program Defensible

A pile of security tools is not a security program. What separates a defensible posture from a vulnerable one is structure, a documented way to identify risk, set priorities, and demonstrate diligence to clients, insurers, and regulators. Two frameworks dominate the conversation.

The NIST Cybersecurity Framework 2.0 organizes the work into six functions, and its 2024 addition of Govern is especially relevant for firms, because it pulls cybersecurity squarely into leadership's enterprise-risk conversation rather than leaving it stranded in the server room.

NIST CSF 2.0 functions, translated for a law firm
Function	What it means in practice
Govern	Assign accountability, define risk appetite, fold cyber into firm governance
Identify	Inventory systems, data, vendors, users, and critical matters
Protect	MFA, encryption, access control, training, endpoint security
Detect	Monitor for abnormal logins, malware, and data exfiltration
Respond	Execute an incident plan with clear roles and legal review
Recover	Restore through tested backups and post-incident improvement

For firms handling personal data across jurisdictions, ISO/IEC 27001 offers a certifiable information-security management standard, with ISO/IEC 27701 extending governance into privacy. Certification is not mandatory for every practice, but alignment with recognized frameworks turns vague assurances into auditable evidence, exactly what a client security questionnaire demands.

The Controls That Earn Their Keep

Identity has become the real perimeter. Once an attacker holds valid credentials, most traditional defenses are moot, which is why multifactor authentication is the foundational control, Microsoft has reported that MFA blocks 99.9% of automated account-compromise attempts, as cited in legal-sector compliance analysis. Beyond MFA, the highest-value controls cluster around limiting damage: least-privilege access, matter-level information barriers, endpoint detection and response, immutable backups, and disciplined offboarding.

Where the Human Element Drives Breaches

Selected factors present in breaches, 2025 DBIR (%)

Source: Verizon 2025 DBIR analysis. Categories overlap across incidents.

Recovery Planning by System Tier

Not every system warrants the same urgency. The discipline of disaster recovery lies in matching restoration targets to business criticality, and, crucially, aligning those internal capabilities with any restoration timelines the firm has promised clients in contracts.

Suggested recovery priorities by system tier
Tier	Examples	Planning priority
Tier 0, Mission critical	Identity, core network, document management	Near-immediate restoration, tested failover
Tier 1, Essential	Email, billing, client portals	Restore within hours, frequent backups
Tier 2, Important support	HR, intranet, conflicts triage access	Restore within a business day
Tier 3, Noncritical	Marketing site, test environments	Longer windows acceptable

Insurance Rewards the Prepared

Cyber insurance absorbs financial shock, but it is no substitute for security, and underwriters increasingly demand evidence of baseline controls before offering favorable terms. MFA, tested backups, endpoint detection, an incident response plan, and vendor risk management are now table stakes for coverage. The payoff for maturity is measurable: organizations that deployed security AI and automation extensively saved an average of $2.22 million per breach compared with those that did not, per IBM's 2024 report.

The Cost Range, and the Value of Investment

Average breach cost by context, USD millions

Source: IBM Cost of a Data Breach Report 2024. U.S. organizations bear the highest average cost worldwide.

Firms should not assume a professional-liability or errors-and-omissions policy will quietly cover data restoration, notification costs, or statutory privacy claims. Those are distinct exposures, and the overlap is narrower than many partners assume, a gap best closed with experienced insurance counsel before, not after, an incident.

A Pragmatic Path Forward

Maturity is not bought in a single purchase; it is built through governance, repeated testing, and a culture that treats client-data protection as part of service quality. For most firms, the sequence matters more than the budget: assign executive ownership and require MFA in the first month; classify data, formalize an incident plan, and run a leadership tabletop within a quarter; align to NIST CSF 2.0 or ISO 27001, commission a penetration test, and formalize AI governance over the year. The resilient firm is not the one that believes it will never be attacked. It is the one that has rehearsed exactly what happens when it is, and can show a client the rehearsal. In a market where clients now audit security before signing, that readiness has quietly become a competitive asset, not merely a defensive cost.