27 law firms. A claimed $207M. It started with phone calls.

Leaked chats attributed to the Silent Ransom Group record about $207M paid by 27 law firms between April and September. No firm has confirmed paying, and blockchain analysts say the evidence supports the scale, not the exact figure.

For firm leaders, the method matters more than the total. A caller poses as IT (or your MSP) and persuades someone to hand over files or access. The FBI says the group has also sent people to law offices in person.

October showed what can follow:

• Sheppard Mullin says one attorney was deceived into handing documents to an outside party, with no access to its systems. Days after its disclosure, a former paralegal filed a proposed class action alleging inadequate training and safeguards. Nothing has been proven.

• Holland & Knight disclosed that social engineering gave an attacker remote access to a firm computer. It notified 14 clients.

These are very large firms, but I wouldn’t take comfort in that. A convincing call doesn’t require a big target, and a 60-lawyer firm holds the same kinds of confidential data.

Three questions for your next leadership meeting:

1. If someone "from our MSP" called one of our partners today, what would they do? Is there a simple way to verify through a second channel, and have we tested it?

2. Who is in charge of incident response for the first 24 hours? Mandiant reports data theft often happens within hours of first contact. Know in advance who calls outside counsel, forensics, and the cyber insurer, how privilege and evidence are protected, and what clients will be told.

3. Who owns this risk? Model Rule 1.6(c) calls for reasonable efforts to protect client information, and “reasonable” is now being argued in court. Someone should own security risk, oversee vendors, and report to leadership in plain business terms. That’s a governance job, not an IT ticket.

(What seems reasonable before a security incident can become much harder to defend afterward, especially when clients question the firm's preparedness.)

If asked "who's in charge," how would you answer? If it's not immediately clear, defining that answer is a good place to start.

#LawFirmManagement #Cybersecurity #IncidentResponse #LegalIndustry