A personal injury firm is an attractive target for attackers. Its files contain medical histories, Social Security numbers, insurance details, and financial information, and its trust account regularly holds large sums that move by wire. Most breaches at small and midsize firms do not involve sophisticated hacking. They begin with a phished password, a spoofed email from a supposed insurer, or a laptop with no encryption. The controls that prevent them are well understood and mostly inexpensive. The challenge is making them routine.
Know What You Hold and Where
Start with an inventory. List where client data lives: the case management system, email, document storage, shared drives, laptops, phones, personal cloud accounts, and third-party vendors such as records retrieval services, e-discovery platforms, and litigation funders. Each location is an exposure point. Identify who has access to each, and remove access that is no longer needed. Departing employees are a common source of lingering access. Make offboarding a documented checklist item that includes accounts, devices, and shared links.
Lock Down Accounts
Multi-factor authentication is the single most effective control against credential theft. Enable it on email, case management, document storage, accounting, and banking portals, and prefer app-based or hardware authentication over text messages where possible. Use a password manager, require unique passwords, and prohibit sharing logins among staff. Review administrator accounts regularly, and limit them to the fewest people necessary.
Email and Wire Fraud
Settlement disbursement is the moment of highest risk. Criminals monitor or impersonate correspondence, then send instructions changing a payee's bank details just before funds move. Adopt a hard rule: no wire or payment instruction changes are accepted by email alone. Verify any change by calling a known number on file, not one provided in the message. Apply the same rule to requests from clients, medical providers, lienholders, and referring counsel. Add a second approver for wires above a threshold, and consider positive pay or similar bank controls on the trust account.
- Flag external emails visibly so staff notice unfamiliar senders.
- Train staff to hover over links and check reply-to addresses.
- Run periodic simulated phishing exercises, and treat results as training, not punishment.
- Provide an easy way to report suspicious messages without fear of blame.
Protect Devices and Documents
Encrypt laptops and phones so a lost device does not become a breach. Enable remote wipe, require screen locks, and keep operating systems and applications updated. Limit the use of personal devices for client work, or place them under a mobile device management policy. For documents, use a platform with access logs and permissions, and avoid sending sensitive files as unprotected email attachments. When clients need to send records, offer a secure upload portal.
Backups and Recovery
Ransomware attacks encrypt files and demand payment for the key. Reliable backups are the main defense. Maintain at least one copy that is offline or immutable, so attackers cannot encrypt it, and test restoration on a schedule. A backup that has never been restored is an assumption, not a plan. Document how long recovery would take, because downtime has real costs, including missed deadlines and delayed disbursements. Confirm that your case management vendor maintains its own backups and understand its recovery commitments.
Vendors and Contracts
Review the security practices of vendors who handle client data. Ask whether they encrypt data in transit and at rest, whether they use multi-factor authentication, how they respond to incidents, and whether they carry cyber insurance. Include notification obligations in contracts, so you learn promptly if a vendor is breached. Be especially careful with offshore or low-cost subcontractors who handle medical records.
Ethics and Legal Duties
Lawyers have professional obligations to make reasonable efforts to prevent unauthorized access to client information, and to communicate with clients if a breach occurs. State breach notification laws may also require notice to affected individuals and regulators within defined periods. Because medical records are involved, consider whether any HIPAA obligations attach through your relationships with covered entities or business associates. Document your safeguards, since reasonableness is typically assessed on the basis of what a prudent firm would do. Our practice operations category discusses related compliance topics, and our liens and settlement category covers trust disbursement workflow.
Prepare an Incident Plan
Write a short plan before you need it. Identify who leads the response, who to call first, and how to reach them outside normal channels if email is compromised. List contacts for your cyber insurer, outside counsel, forensic firm, bank, and case management vendor. Decide in advance how to preserve evidence, isolate affected systems, and notify clients. Run a tabletop exercise once a year to find gaps. Review whether your cyber insurance policy covers business interruption, ransom payments, notification costs, and legal fees, and what conditions it imposes on security practices.
Takeaways
- Inventory data locations and remove stale access promptly.
- Require multi-factor authentication everywhere it is offered.
- Verify payment instruction changes by phone, with a second approver on wires.
- Keep tested, offline backups, and write an incident plan.