7 Cybersecurity Mistakes That Could Cost Your Law Firm Millions in 2027

Most law firm breaches do not begin with a sophisticated zero-day exploit. They begin with an ordinary mistake: a wire instruction that was never verified, an account without multifactor authentication, a backup nobody tested, or a vendor nobody reviewed. Going into 2027, those ordinary mistakes carry extraordinary price tags.

Direct answer: The seven cybersecurity mistakes most likely to cost a law firm millions in 2027 are (1) trusting email for money movement, (2) incomplete multifactor authentication, (3) untested or connected backups, (4) unpatched internet-facing systems, (5) unmanaged vendor and cloud access, (6) uncontrolled use of generative AI with client data, and (7) having no tested incident response plan. Each one is preventable, and each one can trigger direct losses, ransom and recovery costs, malpractice and ethics exposure, client attrition, regulatory scrutiny, and denied or reduced cyber insurance claims.

This guide is educational, not legal advice. It draws on the IBM Cost of a Data Breach Report, the FBI Internet Crime Complaint Center (IC3), the Verizon Data Breach Investigations Report, ABA Model Rule 1.1, ABA Model Rule 1.6, ABA Formal Opinions 477R, 483, and 512, NIST Cybersecurity Framework 2.0, and CISA's #StopRansomware guidance.

Why the stakes are higher for law firms in 2027

Law firms concentrate exactly what attackers want: privileged communications, merger and litigation strategy, personal and financial data, and large trust-account transactions. IBM's annual research has consistently placed the average global cost of a data breach in the multimillion-dollar range, and the professional services sector routinely sits above the cross-industry average. The FBI's IC3 reports that business email compromise remains one of the costliest cybercrimes in the United States, with billions of dollars in reported adjusted losses each year.

On top of direct losses, attorneys carry duties most businesses do not. Under Model Rule 1.1 (Comment 8), competence includes understanding the benefits and risks of relevant technology. Under Model Rule 1.6(c), lawyers must make reasonable efforts to prevent unauthorized access to or disclosure of client information. ABA Formal Opinion 483 adds duties to monitor for, stop, and investigate breaches and to inform clients when a breach affects their information. A security failure can therefore become an ethics complaint, a malpractice claim, and a client-relationship problem at the same time.

Mistake 1: Trusting email to move money

The mistake: Changing wire or payment instructions based on an email, or a phone number provided in that email.

Business email compromise is the single most direct path from an inbox to a seven-figure loss. Attackers compromise or spoof an attorney, client, title company, or opposing counsel account, wait for a closing or settlement, and send "updated" wiring instructions. The FBI's guidance on business email compromise warns that funds must be recovered quickly, often within days, to have any realistic chance of being frozen.

Law firms are especially exposed because real estate, personal injury, and corporate practices routinely move large sums on short timelines. Deepfake voice and AI-written messages make the requests more convincing every year.

How to fix it:

• Adopt a written rule: no change to payment instructions is accepted by email alone.
• Verify every new or changed instruction by calling a known number from the file, never one in the message.
• Require dual approval for outgoing trust-account wires above a set threshold.
• Enforce SPF, DKIM, and DMARC at p=quarantine or p=reject to reduce spoofing of your domain, following CISA's email security guidance.
• Tell clients at intake, in writing, that the firm will never change wiring instructions by email.
• Know the reporting path: contact your bank immediately and file at ic3.gov.

Mistake 2: Incomplete multifactor authentication

The mistake: Turning on MFA for some users or some systems, but leaving gaps on email, remote access, admin accounts, or legacy apps.

Stolen credentials remain one of the most common initial access vectors in the Verizon DBIR. Partial MFA gives a false sense of security: attackers simply target the account or protocol that was left out, such as a partner's personal device, a shared mailbox, a service account, or legacy authentication that bypasses MFA entirely.

Cyber insurers now commonly ask about MFA on email, remote access, and privileged accounts. An inaccurate answer on an application can create grounds to dispute or rescind coverage after a claim.

How to fix it:

• Require MFA on email, document management, practice management, billing, VPN/remote access, cloud consoles, and all administrator accounts.
• Disable legacy authentication protocols that cannot enforce MFA.
• Prefer phishing-resistant methods (FIDO2 security keys or passkeys) for administrators and partners, per CISA's phishing-resistant MFA guidance.
• Run a monthly coverage report and treat any exception as a tracked risk with an owner.

Mistake 3: Backups that have never been restored

The mistake: Assuming backups will work because a dashboard says "successful," or keeping backups on the same network ransomware can reach.

Modern ransomware groups deliberately hunt for and encrypt or delete backups before they launch, then add data theft and public leak threats on top. A firm with connected or untested backups may face weeks of downtime, missed filing deadlines, and pressure to negotiate with criminals. CISA's #StopRansomware Guide recommends offline, encrypted backups that are regularly tested.

How to fix it:

• Follow a 3-2-1 approach: three copies, two media types, one offline or immutable.
• Separate backup admin credentials from everyday domain accounts and protect them with MFA.
• Perform a documented restore test at least quarterly, including a full matter file and a critical application.
• Define recovery time objectives tied to real court and client deadlines.

Mistake 4: Unpatched, internet-facing systems

The mistake: Leaving firewalls, VPNs, remote desktop, file-transfer tools, and web portals unpatched or exposed to the internet.

Attackers scan the entire internet continuously and exploit newly disclosed vulnerabilities within days, sometimes hours. CISA maintains a Known Exploited Vulnerabilities (KEV) Catalog precisely because these flaws are actively used in real attacks. Edge devices and file-transfer platforms have been behind some of the largest mass data-theft campaigns in recent years, affecting law firms alongside their clients.

How to fix it:

• Maintain an inventory of everything the firm exposes to the internet, including forgotten portals and test systems.
• Patch KEV-listed and critical internet-facing vulnerabilities on an accelerated timeline, measured in days, not months.
• Remove open remote desktop and replace it with MFA-protected access.
• Run continuous external monitoring and periodic vulnerability assessments so new exposure is caught as it appears.

Mistake 5: Unmanaged vendor and cloud access

The mistake: Granting IT providers, e-discovery platforms, legal tech tools, and cloud services broad access without reviewing their security or contracts.

A firm's risk includes every vendor that stores client data or connects to its systems. A compromised managed service provider, remote-support tool, or file-sharing platform can expose many firms at once. ABA Formal Opinion 477R and Model Rule 5.3 require reasonable efforts to ensure non-lawyer assistance, including vendors, is compatible with the lawyer's professional obligations. Corporate clients increasingly demand proof of vendor oversight in outside counsel guidelines.

How to fix it:

• Classify vendors by the sensitivity of data they hold and the access they have.
• Collect evidence, such as SOC 2 Type II reports, penetration-test summaries, and MFA confirmation, not just yes/no questionnaires.
• Contract for confidentiality, breach notice within a defined timeframe, data return and deletion, and audit rights.
• Limit vendor remote access to named accounts, with MFA and logging, and remove it when work ends.
• Review high-risk vendors at least annually. See our guide to law firm vendor security assessments.

Mistake 6: Uncontrolled generative AI use with client data

The mistake: Letting attorneys and staff paste client information into public AI tools without a policy, approved tools, or review.

ABA Formal Opinion 512 confirms that lawyers using generative AI must address competence, confidentiality, communication, supervision, candor to the tribunal, and reasonable fees. Self-learning tools may retain or reuse inputs, and courts have sanctioned lawyers for filing AI-generated citations that did not exist. Unmanaged "shadow AI" use also creates data the firm cannot locate, preserve, or delete.

How to fix it:

• Publish a written AI use policy that defines approved tools, prohibited data, and review requirements.
• Choose enterprise AI tools with contractual commitments on data retention, training, and confidentiality.
• Require human verification of every citation, quotation, and factual assertion.
• Consider informed client consent where client confidential information will be input into an AI tool, as Opinion 512 discusses.
• Train attorneys and staff, and log which tools are used on which matters.

Mistake 7: No tested incident response plan

The mistake: Having no written plan, or a plan nobody has practiced, so the first hours of a breach are spent figuring out who to call.

The first 24 to 72 hours determine much of the final cost. Firms without a plan lose evidence, delay containment, miss notification deadlines, and make statements they later regret. ABA Formal Opinion 483 expects lawyers to have a reasonable plan to respond to a breach, and NIST SP 800-61 Rev. 3 aligns incident response with the NIST CSF 2.0 lifecycle. IBM's research has repeatedly found that organizations with tested incident response capabilities experience meaningfully lower breach costs.

How to fix it:

• Write a short, practical plan with named roles, after-hours contacts, and decision authority.
• Pre-select breach counsel, forensics, and communications support, and confirm your insurer's panel requirements before an incident.
• Map client notification duties, engagement-letter commitments, and state breach-notification laws in advance.
• Run a tabletop exercise at least annually covering wire fraud, ransomware, and a vendor breach.
• Preserve logs long enough to investigate, and keep a printed copy of the plan offline.

The seven mistakes at a glance

A 30-60-90 day plan to close these gaps

First 30 days: Adopt the wire-verification rule, run an MFA coverage report and close critical gaps, confirm an offline backup exists, and identify every internet-facing system.

Days 31 to 60: Patch or remove high-risk exposure, test a full restore, publish an AI use policy, and list your top ten vendors by risk.

Days 61 to 90: Finalize the incident response plan, run a tabletop exercise, schedule a penetration test, launch security awareness training, and assemble an evidence file for clients and insurers using compliance reporting.

Frequently asked questions

What is the most expensive cybersecurity mistake for a law firm?

For many firms, the fastest path to a large loss is wire fraud through business email compromise, because funds can be moved within minutes and recovery windows are short. Ransomware and data theft typically produce the largest total cost once downtime, response, liability, and lost clients are included.

Are small law firms really targets?

Yes. Smaller firms hold the same kinds of sensitive data and trust funds as larger firms but often have fewer controls, which makes them attractive targets. Automated attacks do not discriminate by firm size.

Does cyber insurance cover these losses?

Coverage depends on the policy. Many policies include sublimits for social engineering or funds-transfer fraud, require specific controls such as MFA, and can be disputed if the application misstated those controls. Review policy terms with your broker.

What do the ABA rules require for law firm cybersecurity?

Model Rules 1.1 and 1.6, along with Formal Opinions 477R, 483, and 512, require reasonable, risk-based efforts to protect client information, monitor for and respond to breaches, supervise vendors, and use technology competently. State rules vary.

How often should a law firm test its security?

At minimum, firms should monitor externally on a continuous basis, run vulnerability scans regularly, perform a penetration test at least annually or after major changes, test backup restores quarterly, and run an incident response tabletop annually.

Key takeaways

• The costliest law firm breaches usually start with preventable, ordinary mistakes.
• Wire verification, full MFA, tested offline backups, and rapid patching close the most common paths to loss.
• Vendor oversight, AI governance, and a tested response plan are now ethics and client expectations, not extras.
• Documented evidence protects the firm with clients, insurers, and regulators.

Not sure where your firm stands? Start with a free security assessment to see how your firm looks from the outside in minutes.