Attorneys face rising cybersecurity threats as wire fraud schemes grow in frequency and cost. That take and further analysis courtesy of a meandering search of the internet and stumbling across this recent post from Integreon, a global provider of legal and compliance outsourcing. Their article highlights how cyberattacks like business email compromise (BEC) are targeting law firms, especially those holding client funds in escrow.
Cybersecurity Failures in Law Firms
One eye-opening example is the DeLuca v. SutterWilliams LLC case. A hacker impersonated a legal professional via email and convinced another firm to transfer $442,600 to a fraudulent account. The client sued the firm for negligence and legal malpractice. Despite the firm being deceived, courts may still hold it liable.
Business Email Compromise and Wire Transfer Risks
Wire fraud schemes often use business email compromise (BEC). Attackers spoof or hack emails to manipulate financial instructions. The FBI’s 2023 Internet Crime Report noted $2.9 billion in BEC losses, with law firms among the top targets.
Common Cyber Insurance Pitfalls
Many law firms wrongly believe their cyber insurance policies will protect them. However, gaps in coverage often exist. Funds in IOLTA or escrow accounts may not be covered. Policies may also exclude social engineering attacks, which are a major vector for wire fraud. As noted in the Integreon article, “not all cyber insurance policies provide coverage for money held on behalf of others such as IOLTA escrow accounts used for transactional purposes, leaving law firms exposed to significant financial and legal repercussions.”
Insurance Denials and Claim Reporting Issues
Another issue? Claim denials. Even if insured, law firms often lose lawsuits against carriers. Reasons include late reporting, misreporting, or not meeting the insurer’s cybersecurity protocols.
Legal ethics make this worse. Attorneys must comply with ABA Model Rules, including Rule 1.1 on competence and Rule 1.6 on client confidentiality. Failure to verify wire instructions or use security tools like multi-factor authentication may violate these duties.
Action Steps for Legal Cyber Defense
To stay protected, experts recommend four urgent steps:
- Verify all wire instructions by phone.
- Use MFA for financial accounts.
- Train staff to detect phishing attempts.
- Report cyber incidents immediately.
As the post notes, these actions aren’t optional. They’re essential. Cybercriminals continue to evolve, and law firms that ignore cybersecurity do so at their peril.
