eDiscovery Daily Blog

• April 10, 2015

In February, we discussed a report about data breach trends in 2014 and how those trends compared to data breaches in 2013. That report provided breach trends for several industries, including the healthcare industry, which suffered the most breaches last year (possibly because stolen health records are apparently worth big money). But, according to a recent report, you won’t see any trends for law firms because the legal profession almost never publicly discloses a breach.

According to a recent article in The New York Times (Citigroup Report Chides Law Firms for Silence on Hackings, written by Matthew Goldstein), the “unwillingness of most big United States law firms to discuss or even acknowledge breaches has frustrated law enforcement and corporate clients for several years.” This information was according to a recent internal report from Citigroup’s cyberintelligence center that warned bank employees of the threat of attacks on the networks and websites of big law firms.

“Due to the reluctance of most law firms to publicly discuss cyberintrusions and the lack of data breach reporting requirements in general in the legal industry, it is not possible to determine whether cyberattacks against law firms are on the rise,” according to the report, a copy of which was reviewed by The New York Times and discussed in Goldstein’s article.

Issued in February, the report (according to Goldstein’s article) included several observations, such as:

• It is “reasonable to expect law firms to be targets of attacks by foreign governments and hackers because they are repositories for confidential data on corporate deals and business strategies”;
• Bank employees “should be mindful that digital security at many law firms, despite improvements, generally remains below the standards for other industries”;
• Law firms are at “high risk for cyberintrusions” and would “continue to be targeted by malicious actors looking to steal information on highly sensitive matters such as mergers and acquisitions and patent applications.”

According to the article, the bank’s security team also “highlighted several ways hackers had intruded on law firms, by directly breaching their systems, attacking their websites or using their names in so-called phishing efforts to trick people into disclosing personal information”. As a result, Wall Street banks are putting pressure on law firms to do more to prevent the theft of information and are also demanding more documentation from them about online security measures before approving them for assignments.

The report mentioned a handful of law firms who had suffered reported hacks, which apparently led to Citigroup’s distancing itself from the report and stop distributing it.

“The analysis relied on and cited previously published reports. We have apologized to several of the parties mentioned for not giving them an opportunity to respond prior to its publication in light of the sensitive nature of the events described,” said Danielle Romero-Apsilos, a Citigroup spokeswoman.

While law firms apparently aren’t publicly disclosing breaches, they are apparently choosing cyber liability insurance at an increased rate. We will discuss that on Monday.

Thanks to Sharon Nelson and her always excellent Ride the Lightning blog for the tip – her post regarding the story is here.

So, what do you think? How much information do you know about your outside counsel’s security measures? Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscoveryDaily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.