Incident Response · Law Firms · Breach Playbook

A partner opens the laptop on Saturday morning and finds an extortion email addressed to the firm by name, with a sample of client files attached as proof. The next 72 hours decide three things: how much of the matter you keep privileged, whether your ABA Rule 1.6 duty is met, and whether the firm's name appears in a state attorney general's breach register. This is the hour-by-hour playbook, written from a decade of incident response inside law firms.

Key Takeaways

A law firm data breach has at least seven different clocks running in parallel: state breach-notification statutes, contractual notice to enterprise clients, the carrier's strict notice clause, ABA Opinion 483 client-notification duty, HIPAA 60-day rule if you handle PHI, GDPR 72-hour rule if you handle EU data, and the local rules of professional conduct in each jurisdiction the firm practices.
The first call is not to IT, not to the police, and not to the client. It is to breach counsel and to your cyber insurance carrier's pre-approved responder panel. Calling out of order can void coverage and waive privilege.
Engage forensics through breach counsel from minute one. Direct engagement by the firm itself routinely produces a forensic report that is discoverable in the very malpractice litigation it was meant to defend.
By Hour 24 you need a containment posture; by Hour 48 a scoped picture of what was accessed; by Hour 72 a written incident summary good enough to anchor the notifications going out the door.
ABA Formal Opinion 483 imposes a duty to notify affected current clients under Model Rule 1.4 when client information has been compromised. State data breach statutes layer on separate notifications to individuals and regulators.
Paying the ransom is the wrong first question. The right first question is which decryption is faster, cheaper, and more reliable: backup restore or attacker tooling? In most engagements we have run, the answer is backup restore.

A managing partner of a thirty-attorney litigation boutique called us on a Saturday morning earlier this year. Her voice on the phone had a particular quality I have heard exactly four times in the last decade. It is what happens when an experienced lawyer reads an email at 7:42 AM that begins "We have copied 84 GB of your files including matter folders for the following clients" and recognizes that the next move and the move after that will be remembered for the rest of her career.

Three things had happened over the previous 48 hours, in an order none of the people involved would learn until later. A paralegal had clicked a calendar invitation that asked her to re-authenticate to a fake Microsoft 365 page on Thursday afternoon. Her token had been replayed from an IP in a third country on Thursday night. By Friday lunch the attacker had enumerated SharePoint, downloaded a copy of the firm's Documents library, and pivoted to a file server hosting historical matter PDFs. By Friday evening the attacker had encrypted a subset of files and left a note. The partner saw the note and the data-sample link first thing Saturday.

Her instinct was to call the IT vendor. Her second instinct was to call the carrier. Her third was to email the three clients whose matter folders appeared in the attacker's sample. None of those is the right Hour Zero move. Hour Zero is breach counsel, then carrier through breach counsel, then a forensics engagement letter signed by breach counsel and not by the firm. Every other call, including the call to IT, runs better once that chain is in place.

This article is the long version of the conversation that followed. It is written for the people who actually run this at a law firm, the managing partner and the firm administrator, not for a security engineer. By the end you will be able to manage Hour 0 through Hour 72 of a real incident in the right order, and you will know which clock starts when, who you can talk to about what, and how to keep your forensic work product on the privileged side of a future fight.

⚠

Step One

Why Law Firms Are Now a Top-Tier Target

A law firm is not a generic business under attack. From the attacker's point of view it is unusually attractive on three independent dimensions, and the combination of the three is the reason the legal sector has moved from a quiet middle of the breach-frequency table to the top quartile in the last three years.

First, a law firm holds the actionable form of a counterparty's secret. A manufacturer holds drawings; a law firm holds the drawings plus the litigation strategy, the M&A target, the regulatory filing under draft, the divorce inventory, the immigration file, and the privileged communication explaining the weak spot. The attacker who wants to extort a Fortune 500 company has a more efficient route through its outside counsel than through the company itself. Second, a law firm tends to be smaller than its largest client and run on consumer-grade collaboration tools (Microsoft 365 or Google Workspace, Dropbox, NetDocuments, iManage, Clio), which a generalist attacker has practiced against thousands of times. Third, a law firm is exquisitely sensitive to public exposure because confidentiality is not just a preference, it is a Model Rule. The reputational cost of a public breach is higher than the technical cost of the breach itself, and a sophisticated extortionist knows this and prices the demand accordingly.

A practical implication follows. The Hour Zero playbook is not generic. It is tuned to two unusual properties of the legal sector: the duty of confidentiality under Model Rule 1.6, and the privilege questions that determine whether your forensic findings end up in the hands of the plaintiff in a malpractice action. Get either of those wrong and the cost of the incident multiplies. Get both right and even a serious incident closes without lasting damage to the firm.

Figure 1. Three independent properties of a law firm converge into a target profile that pays attackers more than a similar-sized non-legal business.

📞

Step Two

Hour Zero: The Call Order That Protects Privilege and Coverage

The sequence of phone calls in the first hour after discovery is not a matter of taste. It is the difference between a forensic report that survives a future discovery dispute and a forensic report that the plaintiff's lawyer in a malpractice case reads aloud at deposition. It is also the difference between a paid claim and a denied claim under a cyber policy. The right order, in our engagements, is the following.

1. Breach counsel

A specialist privacy and incident-response lawyer, ideally outside the firm and ideally one your malpractice carrier or cyber carrier has on a pre-approved panel. The relationship and the engagement letter you sign in the first hour establish the protective umbrella under which everything else happens. The forensic vendor is hired by breach counsel, the report is written for breach counsel, and the privilege analysis is breach counsel's job, not the firm's.

2. Cyber insurance carrier, through breach counsel

Every modern cyber policy contains a notice provision that runs in days, sometimes hours, and a list of pre-approved responders the firm must use for the incident response to be covered. Calling the carrier yourself before counsel is fine but the cleaner move is to have breach counsel place the call and write the first notice. Engaging a forensic vendor not on the panel is the single most common reason a covered loss converts to an uncovered loss.

3. Forensic vendor, engaged by counsel

A digital forensics and incident response firm that the carrier accepts and that breach counsel selects, engaged on a Kovel-style or work-product letter so the firm's communications and the resulting report sit on the privileged side of the line. The engagement letter should explicitly state that the work is conducted in anticipation of litigation and at counsel's direction. We have seen this single paragraph save firms from disclosing seven-figure investigation files.

4. IT vendor / internal IT lead

After the first three calls, not before. The IT vendor's role is critical and immediate (preserve logs, isolate hosts, freeze identities) but they take instruction from the forensic vendor and breach counsel. Letting IT delete a mailbox or rebuild a server before forensics has imaged it is one of the most expensive mistakes a firm can make.

5. Law enforcement, where appropriate

The FBI accepts ransomware reports through ic3.gov and through its field offices. Reporting is generally low-cost and sometimes useful (the bureau occasionally has decryption keys for known variants). In some sectors and some jurisdictions reporting is mandatory. Do not wire ransom funds without checking the OFAC sanctions list first. A 2020 advisory and the updated 2021 guidance from the Treasury Office of Foreign Assets Control specifically address ransomware payments to sanctioned entities.

6. Clients and bar, on counsel's advice and only after scoping is done

ABA Formal Opinion 483 imposes a duty to notify affected current clients of a material electronic data breach involving their information. The notification is owed under Rule 1.4, the duty to keep clients reasonably informed. The right time to make those notifications is after Hour 48 to 72 when you have a defensible picture of what was actually accessed. Sending a hasty Saturday afternoon "we may have been breached" email to thirty clients before you know anything is a separate professional-responsibility problem.

The single most common error we see is the order being inverted. Firms call IT first, IT engages a forensic vendor they personally know, the firm signs the engagement letter directly, and the resulting report becomes ordinary business records: discoverable, citable, fatal in the malpractice case the firm did not yet know it was about to face. The right order takes the same amount of time and produces a fundamentally different legal posture by the end of Hour One.

⏱

Step Three

The First 24 Hours: Stabilize, Preserve, Contain

By the end of Hour 24 the firm should hold three things. A containment posture that has stopped the attacker from doing further harm. A preservation posture that has captured the evidence forensics will need. And a written, time-stamped chronology that will form the spine of every subsequent notification, claim, and report.

Figure 2. The 72-hour window collapses into three sub-windows. Each one ends with a specific artifact the next one needs.

The two most consequential operational moves inside Hour 24 are identity containment and evidence preservation. Identity containment means revoking sessions and tokens, not just resetting passwords. A reset password without a session revocation leaves the attacker logged in on the device they captured the token from; we have watched attackers continue to read mailboxes for hours after the firm reset every password in the directory. In Microsoft 365 the right sequence is to disable sign-in, revoke sessions in Entra ID, invalidate refresh tokens, and only then rotate credentials and require fresh multi-factor enrollment for every user the forensic team flags. In Google Workspace the corresponding steps live in the admin console under user security and OAuth token revocation.

Evidence preservation means not letting anyone reformat anything. The instinct of an IT team that has just learned about an active breach is to rebuild affected machines. The forensic team needs the unmodified state. Hosts come off the network but stay powered, RAM-captured where possible, and disk-imaged before re-imaging. M365 audit logs and Unified Audit Log queries are pulled now, because retention varies by license tier and the data you need on Tuesday may not exist on Friday. Inbox-rule histories, mail-flow rules, OAuth-application consents, and sign-in logs all need to be captured immediately. We keep a one-page evidence preservation checklist on the wall of the war room for every law-firm engagement we run.

Hour 0-24 Action	Who Owns It	Risk if Skipped
Engage breach counsel	Managing partner	Forensic report becomes discoverable; privilege lost
Notify cyber carrier	Breach counsel	Late notice; coverage denied
Revoke sessions and tokens	Forensic vendor + IT	Attacker stays in mailboxes after password reset
Preserve M365 / Workspace logs	Forensic vendor	Audit-log retention rolls off; scope unknowable
Image affected endpoints	Forensic vendor	RAM and disk evidence lost on reboot or reimage
Confirm offline backup integrity	IT + forensic vendor	Ransom becomes the only restore path
Start written chronology	Firm administrator + counsel	No defensible record for carrier or regulator
Designate spokesperson	Managing partner	Inconsistent partner statements to clients and press
Hold internal-comms brief	Managing partner	Rumor and unauthorized partner emails

📋

Step Four

The Seven Notification Clocks Running in Parallel

A law firm breach is not subject to one notification clock. It is subject to at least seven, each with a different trigger, audience, and form. The clocks run in parallel and do not pause for each other. The clock that owns a Tuesday morning conversation with a state attorney general's office is not the clock that owns the Wednesday call to a Fortune 500 general counsel under an outside counsel guideline, and neither is the clock that owns the call to the bar.

Figure 3. Seven different clocks, seven different audiences. Breach counsel owns the master timeline; nobody else has the full picture.

A few items are worth pulling out of that map. State data breach statutes are not uniform. Most U.S. states define a covered breach by the type of personal information involved (name plus an identifier such as Social Security number, financial account number, or driver's license number), then impose a written-notice obligation to affected residents and frequently to the state attorney general. Some states require notice within a specific number of days from discovery (Florida is 30 days, for example), others use the "without unreasonable delay" standard. New York, California, and Texas each have their own particularities and their own enforcement appetites. The firm's residents-affected list, not the firm's residents-of-origin list, drives which statutes apply.

ABA Formal Opinion 483 (2018) is the cornerstone obligation specific to lawyers. It reads onto Model Rule 1.4 (the duty to keep clients reasonably informed) and Model Rule 1.6 (the duty of confidentiality), and it tells lawyers that they must notify current clients whose material confidential information has been compromised. The opinion does not impose a strict-timing rule of its own but it makes clear that the duty is owed in time for the client to take action to protect themselves. In practice, that translates to client letters going out at the end of Hour 72 or shortly after, once you have a real and defensible understanding of what was accessed.

Contracts with enterprise clients are the wild card. A firm that has signed outside counsel guidelines or vendor agreements with sophisticated clients almost certainly has clauses that require notification within 24 to 72 hours of becoming aware of a security incident, often with a definition of "security incident" that triggers on access regardless of whether confirmed exfiltration has occurred. Read every one of those contracts in the first hours; you are likely already late to one of them by Hour 24 if you do not start drafting that notification at Hour 12.

HIPAA applies if the firm acts as a business associate of a covered entity, which almost any firm with healthcare-sector clients does. The 60-day clock to notify the covered entity runs from discovery of the breach. GDPR applies if the firm holds personal data of EU data subjects, which is common in cross-border practice. The 72-hour clock to notify the relevant supervisory authority runs from awareness, with narrow exceptions for unlikely risk to data subjects' rights.

💰

Step Five

The Ransom Question: How to Frame It Correctly

"Should we pay?" is the wrong question. The right question is "what restores the firm fastest at the lowest total cost while staying inside the law and our policy?" Reframed that way, the ransom is one input among several, and the decision becomes tractable.

Figure 4. The decision tree we walk firms through. The right branch is "restore from backup" more often than firms expect.

Three facts make this decision more constrained than firms initially assume. First, paying a sanctioned entity is illegal in the United States and many other jurisdictions, and OFAC has been explicit since 2020 that facilitating a ransom payment to a designated actor can carry strict liability for the firm and its advisors. Before any payment moves, a careful check of the wallet and the known affiliations of the threat-actor brand is mandatory. Second, recent law in some states (and a federal disclosure rule for public companies and certain critical-infrastructure operators) requires reporting of ransom payments to specific agencies inside short windows. Third, modern cyber policies often condition coverage of the ransom payment itself on advance carrier approval and use of a panel negotiator. Pay first, ask later, and the carrier has a clean reason to refuse the reimbursement.

A different question is whether to engage at all when the attacker is purely an exfiltration extortionist (no encryption, just a threat to publish the data). The argument for engaging is that delayed publication can be worth real money to the firm; the argument against is that paying does not reliably stop publication, and the firm has put itself into a posture where the data is gone, the money is gone, and the public disclosure may still arrive months later. Our default counsel here is to engage only when there is a specific operational reason to (for example, time to notify clients before a leak, or evidence the attacker will accept a structured non-payment outcome), and to engage through a professional negotiator rather than directly.

✉

Step Six

Notifying Clients: The Rule 1.4 Letter That Does Not Make Things Worse

The client notification letter is the single most consequential piece of writing the firm will produce in the first week. It is the document the client's general counsel will forward to their CFO, their board, their own outside counsel, and potentially to a state regulator. It is also the document a plaintiff lawyer will read aloud in the deposition that may follow. It needs to do three things at once: discharge the firm's Rule 1.4 duty to keep the client reasonably informed, provide an accurate factual picture without overstating what is yet unknown, and avoid creating new exposure through careless concessions or speculation.

The structure that works, refined over a decade of these letters, is short and disciplined. The letter is from the firm (not from a single partner), is signed by a named senior lawyer (typically the managing partner or the relationship partner), and contains five sections in this order: (1) a factual paragraph stating what is known about the incident; (2) a specific statement of what client information was affected, scoped to that client; (3) the steps the firm has taken to contain and remediate; (4) a description of the client's likely action items, including credit monitoring or other protective measures where applicable; (5) the firm's contact for follow-up, which should be a single named partner and one paralegal, not "any of us." Avoid the phrase "out of an abundance of caution." It reads as boilerplate. State what you actually know.

Three traps to avoid in the letter. Do not assert that no client information was accessed unless your forensic team has signed off on that conclusion in writing; reversing the assertion two weeks later is the moment your client loses faith. Do not promise specific remediation steps the firm has not actually committed to (a SOC 2 audit, a third-party assessment, a new EDR rollout) unless the partnership has approved the spend; promised-but-undelivered remediation features prominently in malpractice complaints. And do not, under any circumstances, send the letter before breach counsel has reviewed it, because every word in it is a representation the firm will be held to.

Wrong: the "out of an abundance of caution" Saturday email

A two-line note from a partner to thirty clients at Hour 12, before scope is known, hinting at "a possible security event" and promising more information "shortly." The note creates anxiety without giving the client anything to act on, and it commits the firm to a follow-up that may not arrive for days.

Right: the structured Hour 72 letter

A two-page letter, signed by the managing partner, scoped to the specific client, stating what was accessed, what the firm has done, what the client should consider doing, and exactly whom to call with questions. Sent only after the scope is real and after breach counsel has approved every sentence.

🛡

Step Seven

After the Fire: Hardening That Survives the Next Renewal

A firm that has been through a breach has two windows it should not waste. The first is the 90-day window after closure, while the partnership and the board are still paying attention and budgets are unusually available. The second is the upcoming cyber insurance renewal, where the underwriting questions will be tighter than last year and the consequence of an honest "no" will be measured in tens of thousands of dollars of premium and lower sublimits. Both windows close fast.

In our post-incident engagements with firms, the same control set keeps coming back as the highest-leverage post-breach investment. The list is short and it overlaps almost perfectly with the eight gatekeeper controls underwriters now require: phishing-resistant MFA on email and remote access and admin accounts, EDR on every laptop and server with central monitoring, tested offline or immutable backups with a documented restore test, email filtering with link, attachment and impersonation protection, mandatory security awareness training for every employee including partners, timely patching with no end-of-life software, a written and rehearsed incident response plan, and privileged access control with separated admin accounts. The same controls that would have prevented or contained the incident are the controls the next carrier wants attested to on the application. One block of work serves both purposes.

Two specific hardening moves deserve their own attention. The first is a real Microsoft 365 or Google Workspace tenant review by someone who actually understands the platform. The typical law-firm tenant we audit has between fourteen and twenty-two configuration findings that a generalist IT vendor has missed: legacy authentication still enabled, conditional access policies with exceptions older than anyone remembers, OAuth application consents granted years ago, mail-flow rules added by ex-employees, audit-log retention left at the default. The second is a tabletop exercise within 60 days of recovery, run by an outside facilitator, covering exactly the scenario the firm just lived through. Firms that run this exercise once typically reduce the recovery time of a second incident by half. The cost is a fraction of the legal fees from a single bar complaint.

How Atlant Security Helps

24/7 Incident Response for Law Firms

When a partner opens a laptop on Saturday morning to a ransom note, the next 72 hours decide the firm's exposure, its bar standing, and its cyber claim. We run that 72 hours end to end: identity containment in Microsoft 365 or Google Workspace within the first hour, forensic preservation under counsel privilege, clock-by-clock notification mapping, ransom-decision support, and a 30/60/90 hardening plan that aligns to your next insurance renewal.

Senior responder on the first call, no junior triage layer
Engaged through breach counsel to preserve privilege
On every cyber-carrier panel of meaningful size
Fluent in Rule 1.6, Opinion 483, state breach statutes, HIPAA, GDPR
Written report suitable for the carrier, the bar, and the AG

Book a 30-minute readiness call →

❔

Frequently Asked

Questions Managing Partners Ask in Hour One

If we already called our IT vendor first, did we ruin the privilege analysis?

Not necessarily, but the work has to be restructured immediately. The fact that IT was the first call is recoverable if breach counsel is engaged within the first day and forensics is then re-engaged under counsel. What is not recoverable is a forensic report that has already been written and delivered directly to the firm without counsel in the chain. Stop work, pause that report, and re-engage through counsel. The cost is a small amount of repeated effort. The benefit is preserving the privilege posture going forward.

Do we have to tell every client, or only the ones we are sure were affected?

ABA Formal Opinion 483 obliges notice to current clients whose information was materially compromised. If the firm has a clear picture by Hour 72 that a specific subset of clients was affected, the notification goes to that subset. Sending an alarming firm-wide note to clients who were not affected can itself create issues and is generally discouraged unless the firm cannot reasonably scope which clients were affected. State data breach laws operate on a different axis (individuals whose PII was exposed) and have their own scoping rules.

Does cyber insurance actually pay for everything?

A well-structured cyber policy pays for forensic investigation, breach counsel, notification mechanics, credit monitoring offered to affected individuals, the regulatory defense bill, and (subject to sublimits and approvals) the ransom and the business interruption. It does not pay for everything: lost client trust, partner time, the reputational repair work, and any malpractice judgment from a downstream claim are mostly the firm's burden. And it pays nothing if the firm violates the policy's notice clause or uses off-panel responders. The pay-out depends on Hour One discipline as much as on the policy itself.

Is paying the ransom illegal?

Paying a ransom is generally not per se illegal in the United States, but paying a sanctioned entity is, and OFAC has signaled since 2020 that facilitating a payment to a designated actor is sanctionable on a strict-liability basis. The practical answer is that the firm does not pay anything until breach counsel has performed the sanctions check, the carrier has approved the payment, and the payment is routed through a panel negotiator and a panel cryptocurrency facilitator. Improvised payments are the ones that turn into criminal exposure and uncovered claims.

What if we are not yet sure data was actually exfiltrated?

A useful working principle is that access without confirmed exfiltration still implicates duties under Rule 1.6 (the rule reaches unauthorized access, not only disclosure) and frequently under contractual notice clauses (which often trigger on "security incident" rather than on confirmed breach). The right move is to scope as fast as the forensic data allows, notify on the conservative side of the line where contractual clocks are short, and avoid asserting "no data was taken" in any client letter unless the forensic team has signed off on that conclusion in writing.

We are a fifteen-attorney firm. Do we really need all of this?

The decision-making structure is the same at fifteen attorneys as at fifteen hundred; only the dollar amounts and the speed of partner approvals change. The single most useful preparation a small firm can do is to have a one-page incident response plan with the names and phone numbers of breach counsel, the cyber carrier's claim hotline, and a forensic firm on the carrier's panel, kept somewhere accessible without the firm's network. The plan does not need to be long. It needs to exist before the morning the partner finds the email.

The thirty-attorney firm that started this article submitted its state attorney general notice on Day 9, sent client notification letters on Day 11, and closed the matter with no bar complaints and no malpractice filings. The cyber carrier paid the forensic and counsel bills in full and reimbursed the negotiation fee. The firm did not pay the ransom. The decisive moments in that timeline were not the technical work or the size of the ransom demand. They were the order of the first six phone calls on Saturday morning.

If your firm has never written down what those first six calls are and in what order, that is the single most valuable hour you can spend this month. Write it. Tape it to the inside of the file cabinet behind the firm administrator. Hope you never need it.

Need a 24/7 responder relationship in place before the next call? Book a 30-minute readiness call or email alexander@atlantsecurity.com directly.

Law Firm Data Breach: The 72-Hour Playbook That Protects Privilege, Coverage, and the Bar Standing