When a law firm suffers a data breach, the first calls aren’t to IT. They’re to clients — explaining that files they trusted you to protect were accessed by someone else.
That conversation is the real cost. A Sacramento firm can restore encrypted files from a good backup in a day. Restoring a client’s confidence that their matter is genuinely safe with you takes considerably longer, and with some clients it never fully returns.
This isn’t an argument for alarm. It’s an argument for understanding what actually happens to firms, why legal practices are singled out, and which specific controls prevent the overwhelming majority of incidents. Most of what works is neither exotic nor expensive — it’s simply unglamorous enough that it often goes undone.
Why law firms are targeted deliberately
Attackers aren’t selecting firms at random. Legal practices sit at an unusually attractive intersection of factors.
Concentrated valuable data. A single mid-sized firm may hold merger terms, settlement figures, medical records, financial disclosures, intellectual property filings, and personal information across hundreds of clients. Breaching one firm yields data belonging to many organizations — a far better return than attacking those organizations individually.
Genuine time pressure. Firms operate against court deadlines, filing dates, and client obligations that don’t move. Attackers understand that a firm three days from a hearing evaluates a ransom demand very differently than a business with slack in its schedule.
Reputation as leverage. For most businesses, the threat is data loss. For a law firm, the threat is publication. Modern ransomware operators routinely exfiltrate data before encrypting it, then threaten release — a form of pressure that works particularly well when confidentiality is the entire value proposition.
Predictable money movement. Firms handle client funds, settlements, retainers, and real estate transactions. Large wire transfers are normal, expected, and often time-sensitive. This makes legal practices a preferred target for business email compromise, which we’ll return to shortly.
Uneven security maturity. Large firms maintain security teams. Small and mid-sized firms frequently rely on a vendor who resolves problems as they arise — which is a fundamentally different discipline, and not a substitute.
Sacramento compounds several of these. Firms here work with state agencies, regulated industries, government-adjacent clients, and matters that attract public attention. That elevates both the sensitivity of the data held and the scrutiny that follows any incident.
The attacks that actually land
It’s worth being specific, because the popular image of a hacker breaking through defenses bears little resemblance to how firms are actually compromised.
Credential phishing. A message that appears to be a Microsoft 365 password expiry notice, a shared document notification, or a court filing alert. The linked page is a convincing replica of a login screen. Credentials entered there go directly to the attacker, who then has access to email — and everything reachable from it.
Business email compromise and wire fraud. This is the one that costs firms the most money, and it involves no malware whatsoever. An attacker gains access to an email account — often a paralegal’s or an assistant’s — and simply watches. They learn how the firm communicates, who authorizes payments, and when a transaction is approaching. Then, at exactly the right moment, they send updated wire instructions from a legitimate internal account, or from a lookalike domain that differs by a single character. The funds are gone before anyone notices.
Real estate and settlement practices are hit especially hard by this, because large transfers on a known schedule are exactly what the attack is designed to intercept.
Ransomware with double extortion. Files are encrypted and copies are stolen. Even a firm with excellent backups faces a second demand: pay, or the client files are published. Backups solve the availability problem but not the confidentiality one.
Third-party and vendor compromise. Firms exchange documents constantly with co-counsel, experts, court systems, and clients. A compromised contact at any of those organizations produces an email that is genuinely from a real person you genuinely work with.
What breach exposure looks like in layers
The consequences arrive in stages, and most firms anticipate only the first.
Immediate operational loss. Files inaccessible, calendars gone, document management down, staff unable to work — during a period when deadlines don’t pause for technical difficulties.
Notification obligations. Depending on the data involved and the jurisdictions of the affected individuals, you may be required to notify clients, individuals, regulators, and in some circumstances opposing parties and courts.
Professional responsibility exposure. Rules of professional conduct require competence in safeguarding client information. A breach that follows a sophisticated attack against reasonable defenses is a very different conversation than one traceable to a firm that never enabled multi-factor authentication.
Client attrition, mostly silent. Clients rarely announce that they’re leaving because of a breach. They simply send the next matter elsewhere, and referrals quietly slow.
Insurance consequences. Renewals after an incident cost more and impose stricter conditions. Where a firm attested to controls it didn’t actually maintain, coverage may be reduced or denied entirely — the application form is a legal document.
Recovery expense. Forensics, incident response counsel, notification costs, credit monitoring, and after-hours technical labour are all expensive precisely because they’re urgent.
The controls that stop most of this
The genuinely reassuring part is that the majority of successful attacks exploit a short list of gaps. Closing them is neither complicated nor especially costly.
Multi-Factor Authentication, enforced everywhere. Email, document management, remote access, practice management, cloud applications. No exceptions for partners — leadership accounts are targeted specifically because their instructions carry weight. MFA alone stops the substantial majority of account-takeover attempts, which remain the most common entry route into a firm. If you implement one thing from this article, implement this.
Email threat filtering. Most incidents begin with a message. Filtering catches a large proportion before anyone has to exercise judgment, including lookalike domains and spoofed internal senders.
Endpoint detection and response. Traditional antivirus recognizes known threats. EDR watches for suspicious behavior — which is how ransomware gets caught in the minutes between execution and encryption spreading across the network.
Verified, off-site backups. The difference between a bad week and a catastrophe. Backups must be tested rather than assumed, and stored where an attacker on your network cannot reach them. A backup drive connected to your office network is a target, not a safety net.
Secure file sharing. Email attachments are the wrong tool for privileged documents. A secure portal gives clients a safer route and gives the firm an audit trail of who accessed what.
A verification rule for payment changes. This one requires no technology at all, and prevents the single most expensive category of loss. Any change to wire instructions is verified by telephone, using a number the firm already holds — never one supplied in the email requesting the change. Make it policy, apply it without exception, and make clear that nobody will be criticized for slowing a transaction down.
Regular staff awareness training. Your team is the layer that reaches whatever filtering misses. Brief, frequent training measurably reduces click rates, and a culture where reporting is welcomed rather than punished turns your entire staff into an early warning system.
Our cybersecurity services implement these as a coordinated layer rather than as separate products, and our managed IT services keep them monitored and current — because a control nobody is watching drifts out of effectiveness within months.
The question clients have started asking
Something has shifted quietly in the last few years. Corporate and institutional clients increasingly send security questionnaires to outside counsel. Insurers require documented controls before issuing coverage. Some clients now require evidence of MFA and tested backups as a condition of engagement.
This is worth noticing, because it changes the nature of the decision. Security is moving from a back-office concern into something firms are asked to demonstrate — with documentation, not assurances.
Being able to answer clearly is becoming a competitive position rather than a compliance chore. A firm that can respond to a client’s due diligence questionnaire immediately, with dates and evidence, is in a materially stronger position than one that needs three weeks and produces vague answers.
The questions asked most often are worth checking against your own firm today: Is MFA enforced across all accounts? When was recovery last tested? Who has access to client data, and when was that reviewed? How is staff trained, and how often? What is your incident response plan?
The first 72 hours: what a plan should already say
Most firms make their most consequential decisions during an incident, under pressure, for the first time. A written plan removes that improvisation, and it doesn’t need to be long — it needs to exist before it’s needed.
Hour one: contain, don’t diagnose. The instinct is to work out what happened. The correct first action is to limit spread — isolating affected machines from the network while leaving them powered on, because shutting down destroys evidence that determines whether client data was actually taken.
Hour two: call the right people in the right order. Your IT provider, your cyber insurer (many policies require prompt notification and mandate approved response vendors), and incident response counsel. That last one matters more than firms expect: engaging counsel early can bring the investigation under privilege, which materially affects what has to be disclosed later.
Day one: establish what was accessed, not just what was encrypted. These are different questions with different obligations. Encryption is an availability problem. Exfiltration is a confidentiality problem, and it drives notification requirements.
Day one to three: decide what clients are told, and when. Silence is the wrong instinct. Clients who learn about an incident from a third party, or discover it was concealed, respond considerably worse than clients told directly and early. Prepare the communication before you need it.
Throughout: keep a written record. What was found, when, what was decided, by whom. Insurers, regulators, and potentially a court may want this later, and memory reconstructed weeks afterward is unreliable.
Afterward: establish how they got in. Firms that restore systems without identifying and closing the entry point — and without removing the attacker’s persistence — are frequently compromised again within months. Recovery isn’t complete when the files come back.
A plan covering these points fits comfortably on two pages. Writing it takes an afternoon. Not having it is what turns a manageable incident into a chaotic one.
What good looks like for a Sacramento firm
Firms that have addressed this properly end up with a consistent arrangement: MFA enforced without exception, email filtering and DNS protection stopping threats before they arrive, endpoint detection watching behavior across every device, patch compliance maintained automatically above 98%, backups verified daily and recovery tested quarterly with documentation retained, continuous monitoring of the whole environment, and a written incident response plan naming who does what.
None of that is dramatic. It’s simply maintained, monitored, and documented — which is precisely what a busy firm has no spare capacity to manage internally, and precisely what a break-fix vendor is not structured to provide.
Protecting privilege in practice
Confidentiality is the foundation the attorney-client relationship rests on. Every other part of a firm’s value depends on it holding — and increasingly, on being able to show that it holds.
RJ PRO Tech Group works with Sacramento law firms to make that foundation genuinely defensible: layered protection, verified recovery, documented controls, and a Help Desk that responds in minutes when something needs attention during a filing week.
Schedule a complimentary IT assessment for your Sacramento firm. We’ll show you exactly where your exposure sits — before someone else finds it.
