Law Firm Cybersecurity Best Practices for 2026

Law firm cybersecurity best practices start from a simple fact: firms hold money and confidential information, and attackers know it. The FBI’s latest crime report puts business email compromise, the scam where criminals impersonate a trusted party to redirect a payment, among the costliest crimes it tracks. For lawyers, the professional rules add duties that go beyond what most businesses face, including a duty to tell clients about some breaches.

This guide covers the threat data, the rules that frame a firm’s duties, a practical baseline drawn from public frameworks, and what the ABA says happens after a breach. It is about the firm’s own systems. Checking a vendor’s security is a separate job. This article describes practices and rules; it is not legal advice.

The Threat and the Rules

The FBI’s 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in reported losses in 2025, with losses up 26% from 2024. Business email compromise accounted for $3,046,598,558 of reported losses, up from $2,770,151,146 in 2024. The report covers all victims, not just law firms, but the pattern fits legal work closely: firms move settlement funds, retainers and real estate closing money by wire, often on instructions that arrive by email.

Three ABA Model Rules frame a firm’s duties. Rule 1.6(c) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” Comment 8 to Rule 1.1 says competence includes keeping abreast of “the benefits and risks associated with relevant technology.” And Rule 1.15 governs client funds, which is where a successful wire fraud lands.

The rules say “reasonable,” not perfect. They do not list specific controls, so firms usually turn to public frameworks to decide what reasonable looks like for their size. States adopt their own versions of these rules, so the local text governs.

A Practical Baseline

A common public reference is NIST’s Cybersecurity Framework 2.0, released February 26, 2024. It organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. The Govern function covers the organization’s risk strategy, roles and policies, which for a firm means deciding who owns security decisions.

For a small firm, the framework translates into a short list of habits. Know what systems and data you have and where client files live. Protect accounts with strong authentication, keep devices updated, and back up data in a way an attacker cannot reach. Train everyone to spot phishing, and set a rule that payment instructions received or changed by email are confirmed by phone at a known number. The UK’s National Cyber Security Centre publishes a free small organisations guide built around similar steps: backups, protecting devices and accounts, and spotting scams.

Plan the response before it is needed. Decide who the firm calls first, such as an insurer, outside counsel or a forensic firm, and keep that list somewhere that does not depend on the firm’s own email.

What Happens After a Breach

ABA Formal Opinion 483, issued October 17, 2018, addresses lawyers’ obligations after a data breach or cyberattack. It concludes that lawyers must make reasonable efforts to monitor their technology, office resources and vendors so a breach is not discovered by chance. When a breach involves, or has a substantial likelihood of involving, material client information, the opinion says lawyers have a duty to notify clients under Rule 1.4 and to take other reasonable steps.

The opinion draws a line. A ransomware attack that did not make client information inaccessible for a material time, and did not expose it, does not require notice under the opinion. Disclosure is required if material client information was actually or reasonably suspected to have been accessed, disclosed or lost. At minimum, clients must be told that unauthorized access occurred or is suspected, and the known extent of it. State breach notification laws can impose separate duties.

Common Questions

What are the biggest cybersecurity threats to law firms?

The FBI’s data puts business email compromise, at more than $3 billion in reported 2025 losses, among the costliest crimes overall. For firms that handle client funds, payment fraud is the clearest risk.

Do lawyers have to tell clients about a data breach?

ABA Formal Opinion 483 says lawyers must notify current clients when a breach involves, or is substantially likely to involve, material client information. State rules and laws may differ.

What cybersecurity framework should a small law firm use?

NIST’s Cybersecurity Framework 2.0 is free and scales to small organizations. The UK NCSC’s small organisations guide is a shorter starting point.

Is cybersecurity part of a lawyer’s duty of competence?

ABA Model Rule 1.1, Comment 8, says competence includes understanding the benefits and risks of relevant technology.

The Verdict

Real. The threat is documented in FBI data, and the ABA has spelled out duties before and after a breach. The controls that matter most for small firms are inexpensive habits, especially confirming payment instructions by phone, and the hardest part is making them routine.