Your Law Firm's Client Files Were Breached. Attorney-Client Privilege Won't Protect You from the Fallout.

20% of U.S. firms

Hit by a cyberattack in the past 12 months (2025)

$5.08M avg breach cost

Law firm average — up 10% YoY

116K individuals

DocketWise legal SaaS breach — Oct 2025

May 2025 FBI advisory

Silent Ransom Group targeting law firms

Why Attackers Target Law Firms First

A law firm is not just a business. It is a repository of concentrated secrets held on behalf of people who trust the firm with information they cannot afford to have exposed. M&A transactions in progress. Litigation strategy before it reaches a courtroom. Financial records, medical history, trade secrets, personal communications — gathered into organized files, stored in one place, and often protected by security infrastructure that does not match the value of what is stored there.

That asymmetry is why law firms are premium targets. One successful intrusion gives an attacker access to the secrets of every client at the firm. A breach at a corporation exposes that corporation. A breach at a law firm exposes the corporation, its executives, its pending deals, its legal vulnerabilities, and its adversaries — simultaneously.

2025 was the year the attack economy caught up with that asymmetry. According to industry surveys, 20 percent of U.S. law firms were hit by a cyberattack in the past twelve months, and 56 percent of the breached firms lost sensitive client information. The average cost of a law firm breach reached $5.08 million — a 10 percent year-over-year increase. The FBI formally warned the legal profession in a May 2025 IC3 advisory that a threat actor was specifically targeting law firms. The incidents below are not hypothetical scenarios. They happened at named firms during 2025 and the disclosure window that has carried into 2026, with documented victims, regulatory consequences, and dollar amounts attached.

The 2025 Incident Record

Firm / Platform	What Happened	Outcome
Berkeley Research Group (BRG)	Ransomware attack in March 2025 hit the firm during a $700 million leveraged buyout by TowerBrook Capital Partners; M&A intelligence across hundreds of concurrent deals exposed	Active deal compromise; M&A counterparty disclosures; unresolved downstream litigation
DocketWise (legal SaaS)	October 2025 breach of the cloud-based case management platform used by immigration attorneys; an unauthorized actor used valid credentials to copy data affecting 116,666 individuals across multiple law firm customers	Class action filed; notifications began April 3, 2026; vendor-breach-as-firm-breach precedent
Law firms targeted by Silent Ransom Group	FBI IC3 advisory issued May 23, 2025 warning that Silent Ransom Group (aka Luna Moth / Chatty Spider / UNC3753) is specifically targeting U.S. law firms — vishing calls posing as IT support, followed by remote-access installation and data exfiltration via WinSCP or Rclone	Ongoing active campaign; multiple U.S. firms confirmed compromised in 2025
Williams & Connolly	Nation-state intrusion attributed to Chinese state-sponsored actors exploiting a zero-day vulnerability; firm handled sensitive litigation and regulatory matters	National security implications; ongoing federal investigation; client disclosure pressure
Orrick, Herrington & Sutcliffe	Network intrusion exposed files on 637,000 individuals; the $8M class action settlement received final court approval in 2025 after multi-state AG coordination	$8M class action settlement finalized; multi-state AG settlements; breach response template for the sector
Gunster, Yoakley & Stewart	Data breach affecting approximately 10,000 individuals; class action resolved in the 2025 settlement cycle	$8.5M class action settlement — larger than Orrick on a per-affected-individual basis
RansomHub affiliate attacks on legal sector	RansomHub emerged in 2025 as the dominant ransomware-as-a-service operation after absorbing affiliates from disrupted LockBit and ALPHV/BlackCat operations; 90/10 profit split attracted the most capable operators; legal sector targeting escalated throughout 2025	20+ U.S. law firms observed in active C2 communications by threat intelligence firms; multiple confirmed intrusions

These are not small firms with underfunded IT departments. Berkeley Research Group is a top-tier consulting and expert-witness firm embedded in major M&A transactions. Williams & Connolly is one of the most respected litigation boutiques in the U.S. Orrick is an Am Law 100 firm. DocketWise is the practice management platform trusted by thousands of immigration attorneys. If those organizations and platforms cannot hold the line, the question for every other firm is not whether they are at risk — it is whether they have done the work to actually reduce it.

Berkeley Research Group: When the Breach Hits Mid-Deal

In March 2025, a ransomware attack hit Berkeley Research Group while the firm was embedded in a $700 million leveraged buyout of BRG itself by TowerBrook Capital Partners. BRG is not a traditional law firm — it is an expert-witness and consulting firm that provides financial analysis, valuation work, and testimony in high-stakes litigation and M&A transactions. Its files contained working papers on hundreds of concurrent matters across multiple client engagements, each one involving material non-public information about companies that had retained BRG as an advisor.

The timing of the attack was the worst possible scenario. A ransomware event during active buyout negotiations meant the attackers had leverage not just over BRG but over the TowerBrook transaction itself, the sellers, the financing banks, and every portfolio matter BRG was working on at the time. The breach forced BRG to disclose the incident to counterparties across the deal stack, each of whom then had to assess their own exposure to data that BRG had been holding on their behalf.

The BRG incident is the 2025 case that illustrates a shift in the attack economy. Threat actors are no longer choosing targets opportunistically. They are researching which firms are embedded in ongoing high-value transactions and timing their intrusions to maximize leverage. For law firms and professional services firms handling M&A, litigation, or regulatory matters, “what are you working on right now” is no longer a question only the client knows the answer to.

DocketWise: Your SaaS Vendor Breach Is Your Firm’s Breach

DocketWise is a cloud-based case management platform used by immigration attorneys across the United States. In October 2025, the platform detected unauthorized access: an attacker used valid credentials to copy data from the DocketWise environment, exposing the personal and case-related information of 116,666 individuals belonging to multiple law firm customers of the platform. Notifications to affected individuals began April 3, 2026 — roughly six months after discovery — and a class action has been filed.

The DocketWise case illustrates a vendor-breach-as-firm-breach pattern that has become the dominant category of 2025 legal-sector incidents. A law firm may have rigorous internal security controls and still be exposed through the software vendors, cloud services, and technology partners that touch client data. Every tool in the firm’s stack that processes, stores, or transmits client files is part of the attack surface — and in 2025, that stack includes case management platforms, e-discovery vendors, document review services, cloud storage providers, and practice management software that most firms treat as infrastructure rather than as a security boundary.

For immigration law firms using DocketWise, the breach created a compliance problem none of them chose: their clients — often asylum seekers, visa applicants, and individuals with elevated sensitivity around personal information — had their data exposed through a platform the firm contracted with in good faith. The firms themselves did nothing technically wrong. They still owe the notification, the credit monitoring offer, the client communications, and the legal defense of the downstream class action.

Third-Party Risk Is Not Theoretical: If your firm uses cloud-hosted document management, e-discovery platforms, case management software, secure file sharing tools, or any vendor SaaS that processes client data, you bear exposure for their security posture. Vendor security questionnaires are a starting point, not a substitute. In 2025, the DocketWise breach affected more than 115,000 individuals across multiple law firms that had no control over the compromise.

Silent Ransom Group: The FBI Warned the Legal Sector Directly

On May 23, 2025, the FBI’s Internet Crime Complaint Center (IC3) issued a public advisory titled “Silent Ransom Group Targeting Law Firms.” The advisory is unusual because it names a specific sector — the legal profession — as the priority target of an active, named threat group. The FBI almost never issues sector-specific advisories of this kind. When it does, it is because the intelligence community has observed enough confirmed compromises to warrant a public warning to the entire sector.

Silent Ransom Group — also tracked as Luna Moth, Chatty Spider, and UNC3753 — shifted tactics in 2025 in a way that specifically exploits law firm operating patterns. The group now begins an intrusion with a phone call to a firm employee, posing as a member of the firm’s own IT department and walking the victim through installing a remote access tool on the victim’s workstation. Once remote access is established, the attackers exfiltrate data using legitimate tools — WinSCP (Windows Secure Copy) or renamed copies of Rclone — which are unlikely to trigger endpoint detection alerts because they are not malware per se.

The extortion phase is directed at the firm and, separately, at individual employees who are called at their work numbers and pressured to push for a ransom payment. Partners are called directly. Data tranches are released on dark web infrastructure if the firm delays. The FBI advisory documented specific indicators of compromise, the TTPs the group uses, and mitigation recommendations centered on out-of-band verification of any IT-support contact initiated by phone.

A Named Threat Group Is Hunting Your Sector: The May 2025 FBI advisory on Silent Ransom Group is an explicit warning that a capable threat actor is prioritizing law firms as targets. If your firm has not briefed every employee on the vishing-based social engineering pattern described in the advisory — an IT-support phone call leading to remote access software installation — you are relying on luck, not preparation.

Williams & Connolly and the Nation-State Question

The Williams & Connolly compromise sits in a different category from the ransomware and SaaS incidents. Chinese state-sponsored threat actors exploited a zero-day vulnerability to gain access to the firm’s network — one of the most respected litigation boutiques in the United States, handling sensitive regulatory, white-collar, and national security matters on behalf of corporate and individual clients whose identities are themselves often sensitive.

Nation-state intrusions at law firms raise a problem that civil litigation and ransomware do not. The objective is typically not monetary. The objective is intelligence — knowing which companies are receiving advice on specific regulatory matters, which executives are under internal investigation, which litigation strategies are being prepared, and which clients are in discussions with which government agencies. That knowledge is actionable whether or not it is ever exfiltrated publicly.

A breach at a law firm can trigger regulatory proceedings, counterintelligence inquiries, and client disclosure obligations — regardless of whether the firm itself believes client data was accessed. The breach is the trigger. The firm’s assessment of what was taken is one data point, not the final word.

For any firm handling work that touches securities, national security, export controls, foreign investment review (CFIUS), or corporate governance investigations, the Williams & Connolly case is a prompt to ask a harder question: how would you know, today, whether your environment had been quietly compromised by an actor whose goal is to read without being detected? Most firms have no detection capability that would answer that question honestly.

ABA Model Rule 1.6 and the Competence Duty

Attorney-client privilege is a doctrine about what is admissible in legal proceedings. It does not restrict what regulators can investigate, what plaintiffs can claim, or what a ransomware group can publish. The privilege is a legal protection against compelled disclosure in litigation. It was not designed for, and does not address, network intrusions by criminal actors or foreign intelligence services.

The ethical framework that actually governs this situation is ABA Model Rule 1.6(c), amended in 2012, which states: “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” The comment to Rule 1.6 specifically identifies factors that determine whether the efforts were reasonable — including the sensitivity of the information, the likelihood of disclosure absent additional safeguards, the cost of additional safeguards, and the extent to which the safeguards would adversely affect the lawyer’s ability to represent clients.

ABA Formal Opinion 477R, issued in 2017 and clarified in subsequent opinions, went further. It stated explicitly that competent representation now requires “understanding the benefits and risks” of the technology used in the representation. State bar ethics opinions have followed. The New York State Bar Association, the California Bar, and others have issued guidance linking cybersecurity competence to the core duty of competence under Rule 1.1.

Bar Discipline Is on the Table: Law firms that experience a breach and are found to have skipped basic security controls do not just face civil liability. They face ethics proceedings. The duty of competence, as interpreted by bar associations and the ABA, now encompasses cybersecurity. “We did not know” is not a defense when the duty to know is established.

Class Actions Are Now a Template, Not a Novelty

The Orrick Herrington & Sutcliffe $8 million class action settlement, finalized in 2025, is now being used by plaintiffs’ firms as a template for law-firm breach litigation. Gunster, Yoakley & Stewart — a smaller Florida firm whose breach affected roughly 10,000 individuals — settled a parallel class action in the same cycle for $8.5 million. On a per-affected-individual basis, the Gunster settlement is an order of magnitude larger than Orrick’s, which signals that the plaintiffs’ bar has calibrated its damages theory to the sensitivity of the data rather than the count alone.

The broader 2025 data tells the same story. Average breach cost for U.S. law firms reached $5.08 million, a 10 percent year-over-year increase. For small firms and sole practitioners, the average lands around $36,000 — still well above what most small-firm reserve accounts are prepared to absorb. Only 34 percent of law firms had an incident response plan in place despite 80 percent carrying technology insurance, which creates an adverse-selection problem in the cyber liability insurance market that is already tightening underwriting terms for legal practices.

The signal is not the dollar amount in any individual settlement. It is the prosecutorial and litigation theory. State attorneys general are investigating law firms directly. Bar associations are issuing ethics opinions connecting cybersecurity to the duty of competence. Plaintiffs’ attorneys have learned how to sue law firms for breach-related harm and have case law to work from. The enforcement appetite exists. The regulatory framework exists. The only variable is whether a firm gives a plaintiff’s attorney or an AG’s office a reason to look.

The Security Posture Most Firms Actually Have

The gap between what law firms hold and what they protect is structural. Law firms are organized around billing, practice groups, and client relationships. IT is often treated as overhead. Security is a subset of IT. The result, in most firms below the Am Law 200, is a security posture built on antivirus software, a firewall that has not been reviewed in two years, and a password policy that partners routinely ignore because the managing partner’s assistant needs to check email on an iPad.

Multi-factor authentication adoption in the legal sector lags most other professional services industries. Endpoint detection and response is not standard even at mid-size firms. Incident response plans, where they exist, tend to be documents that were written once, never tested, and never updated when the firm added cloud-based document management or moved to Microsoft 365. Vendor security assessments are rare. Employee phishing training is annual at best.

This is not an indictment of individual IT professionals at these firms. It is a description of what happens when an organization’s leadership does not treat cybersecurity as a core operational requirement. The partners who resist MFA are the same partners who hold the client relationships the firm’s reputation depends on. The authority to require security controls and the authority to generate revenue are often held by the same people, and those people have historically chosen convenience.

What a Breach Actually Costs a Law Firm

The immediate costs of a law firm breach are measurable: forensic investigation, notification to affected individuals, regulatory response, credit monitoring services for affected parties, and legal defense of the inevitable class action. For a mid-size firm breached in 2025 or 2026, those costs realistically land between $500,000 and $3 million before any settlement. For a larger firm, they go higher.

The costs that do not appear in a settlement figure are harder to quantify and more likely to determine whether the firm survives the incident. Clients who receive breach notification letters ask questions. Some of them ask those questions to other law firms. Lateral partners evaluating whether to move their practice do not want to bring clients to a firm with a data security incident in its recent history. Sophisticated clients — financial institutions, healthcare systems, public companies — increasingly require cybersecurity attestations from outside counsel as a condition of engagement.

The competitive consequence of a breach is not captured in settlement amounts. It is captured in the clients who quietly move their work and never say why.

Where to Start

The security fundamentals that would have made several of the incidents above either impossible or significantly harder to execute are not exotic. They are well-documented, widely available, and implementable at any firm size.

Controls That Address the Documented Attack Patterns

• Multi-factor authentication on all email, document management, and remote access systems — this is the single highest-return control available and the one most commonly skipped at the partner level
• Privileged access management: restrict who can access which client files and log every access event — broad file-share permissions are still the most common finding in law firm breach forensics
• Endpoint detection and response on all firm devices, including partner-owned laptops and mobile devices used for firm business — SRG’s 2025 vishing campaign specifically exploited the gap between what EDR catches and what WinSCP/Rclone data exfiltration looks like to legacy tools
• Vendor security review process for every SaaS tool and cloud service that touches client data — the 2025 DocketWise breach affected 116,000 individuals across multiple law firm customers who had no control over the compromise
• Out-of-band verification for any IT-support contact initiated by phone — the Silent Ransom Group FBI advisory (May 2025) documents that the current dominant attack pattern against law firms begins with a call from someone claiming to be the firm’s own IT department
• Tested incident response plan: written, distributed, reviewed with outside counsel and your cyber insurance carrier, and exercised at least annually through a tabletop
• Cybersecurity training that goes beyond annual compliance checkboxes — phishing simulation with firm-specific lures targeting the actual role types in your organization
• Cyber liability insurance with limits appropriate to the sensitivity and volume of client data you hold — most mid-size firm policies are underwritten for the wrong risk profile
• Data retention and destruction policy: client files should not live in perpetuity on accessible servers after a matter closes

The Governance Question

Beyond technical controls, the governance question is whether any partner or administrator has clear ownership of cybersecurity decisions. Most law firms have no equivalent of a CISO. The managing partner is responsible for everything and therefore accountable for nothing specific. When a breach occurs, there is no single person who can answer the regulator’s first question: who was responsible for information security at this firm?

Assigning that accountability — even to a part-time or fractional security resource — creates the organizational pressure to actually maintain the controls that a written policy says should exist. Without accountability, policies are aspirational documents that nobody enforces when they conflict with a partner’s convenience.

Practical Entry Point: A risk assessment scoped to your client data posture — what you hold, where it lives, who can access it, and how it is protected — takes less time than you expect and produces a prioritized list of what to fix first. It also creates documentation that demonstrates reasonable effort if a breach occurs and a regulator asks what you did before the incident.

The Privilege That Actually Protects You

Attorney-client privilege protects communications. It does not protect the firm from the consequences of a breach. The actual protection — against liability, against regulatory sanction, against bar discipline, against competitive damage — is the security posture you build before an incident occurs.

The firms listed in this post did not set out to fail their clients. They operated with security programs that were insufficient for the threat environment they were in. The threat environment has not changed in a direction that makes that posture more acceptable. State attorneys general are investigating law firms. Bar associations are issuing ethics opinions that connect cybersecurity to core professional duties. Plaintiffs’ attorneys have learned how to sue law firms for breach-related harm. The posture that was marginally acceptable five years ago is a liability today.

The work required to close that gap is not beyond reach for any firm that decides to do it. The question is whether leadership treats it as a priority before the incident that makes it impossible to ignore.

Security Medic Consulting Works with Law Firms

We deliver fractional CISO services and cybersecurity risk assessments scoped to the legal sector. We understand ABA Model Rule 1.6 obligations, state bar ethics guidance, and the specific threat patterns targeting law firms. If your firm needs a clear-eyed assessment of where it stands and a practical roadmap to reduce client data exposure, that is exactly what we do.

Talk to a Fractional CISO

Sources and References

1. Federal Bureau of Investigation, Internet Crime Complaint Center. (2025, May 23). Silent Ransom Group Targeting Law Firms (Public Service Announcement). ic3.gov
2. Federal Bureau of Investigation. (2025). FBI Cyber Alerts — 2025 Index. fbi.gov
3. Recorded Future. (2025). The Hidden Cascade: Why Law Firm Breaches Destroy More than Data. recordedfuture.com
4. Help Net Security. (2025, September 23). Cybercriminals are going after law firms’ sensitive client data. helpnetsecurity.com
5. ClassAction.org. (2026, April). DocketWise Data Breach Affects 116K, Lawsuit Possible. classaction.org
6. Embroker. (2025). Law firm cyberattacks: Stats and trends for 2025. embroker.com
7. Secnap. (2025). The Escalating Cyber Threats to Law Firms in 2025. secnap.com
8. BleepingComputer. (2025). FBI warns of Luna Moth extortion attacks targeting law firms. bleepingcomputer.com
9. HIPAA Journal. (2025). Orrick Herrington & Sutcliffe Class Action Settlement — Final Approval. hipaajournal.com
10. American Bar Association. (2012). Model Rules of Professional Conduct, Rule 1.6: Confidentiality of Information. americanbar.org
11. American Bar Association Standing Committee on Ethics and Professional Responsibility. (2017). Formal Opinion 477R: Securing Communication of Protected Client Information. americanbar.org