Part one of a three-part series on data-breach risk in small and mid-sized law firms. This installment maps the threat. Part two examines what it does to your ethical and legal exposure. Part three puts a price on inaction — and shows what a defensible firm looks like. You can download a copy of The Small Law Firm Cybersecurity Controls Map fee here.

The Short Version

Small and mid-sized law firms are prime targets — they hold the same high-value data as large firms but rarely have the defenses. ABA data shows roughly 29% have been breached, yet most lack an incident response plan, cyber insurance, or even basic multi-factor authentication. Attacks arrive mainly through stolen credentials, phishing, ransomware, business email compromise (a direct threat to client trust accounts), and vendor compromises — and generative AI now adds a new confidentiality risk when staff paste client data into public tools. The takeaway: data protection is a leadership and professional-responsibility issue, not just an IT problem, and the firms that fare best are the ones that can show the reasonable steps they took.

Small Law Firm Data Breaches: What's Really Happening

Ask a managing partner at a 12-lawyer firm whether they're a target for cybercriminals, and you'll often hear some version of the same answer: "We're too small to bother with." It's an understandable instinct. It's also precisely backwards.

Law firms sit on a concentration of value that few other small businesses can match — privileged communications, merger and acquisition terms, intellectual property, litigation strategy, and the personal and financial data of every client they've ever served. A small firm holds the same categories of sensitive information as a large one; what it usually lacks is a dedicated security team to protect it. Attackers understand that math better than most firms do. The result is a structural mismatch between the value of the data a firm holds and the maturity of the defenses guarding it.

This series is written for the firms living inside that mismatch. Let's start with what is actually happening.

Smaller firms are breached — and they're the least prepared

The most reliable law-firm-specific data comes from the American Bar Association's annual Legal Technology Survey. In the ABA's 2023 Cybersecurity TechReport, 29% of responding attorneys said their firm had experienced a security breach at some point — up from 27% the year before, with another 19% answering "don't know," which is its own kind of answer.

The more revealing number is what sits underneath that average. Breach rates climb with firm size, but preparedness collapses as firms get smaller. In the ABA's data, only 34% of firms had a written incident response plan, and among solo and small firms that figure fell to roughly 19%. Only about 40% carried cyber liability insurance — down from 46% the prior year — with the smallest firms lowest of all. Barely half of attorneys reported that multi-factor authentication was even available to them, despite MFA stopping the overwhelming majority of credential-based attacks.

Read those numbers together and a picture emerges. Two-thirds of firms have no plan for the day a breach happens. Three in five have no insurance to absorb the cost. Nearly half lack the single most effective control against the most common attack. The exposure isn't theoretical, and it isn't concentrated at the top of the market — it's heaviest exactly where defenses are thinnest.

How firms actually get hit

Breaches don't usually arrive as the cinematic "hacker breaking through the firewall." They arrive through people and process. A few patterns dominate.

Stolen credentials and phishing lead the field. Across Verizon's long-running Data Breach Investigations Report, stolen credentials have played a role in roughly a third of breaches over the past decade, and the large majority of breaches involve a human element — someone clicking, someone tricked, someone making an error. For law firms specifically, the FBI has issued repeated advisories about the Silent Ransom Group (also called Luna Moth), which has spent the last several years targeting U.S. firms primarily through social engineering and IT-impersonation rather than malware. In 2026 the Bureau warned the group had even begun sending people physically into firm offices.

Ransomware and extortion remain pervasive. Verizon's most recent reporting found ransomware present in 88% of breaches at small and mid-sized organizations — the closest available proxy for a small law firm. The economics have shifted (fewer victims are paying), but the operational damage of locked systems and stolen files lands hardest on firms without tested backups.

Business email compromise quietly does the most financial damage. The FBI's Internet Crime Complaint Center has tracked more than $55 billion in cumulative global BEC exposure between 2013 and 2023, and it singles out real-estate closings and legal settlements as among the most-targeted transactions. For a law firm, this is the nightmare scenario: a fraudulent wire instruction redirects funds out of a client trust account — which doesn't just lose money, it misappropriates other clients' funds and triggers direct professional-responsibility and malpractice exposure.

Your vendors are part of your attack surface. Roughly a third of breaches in recent Verizon data involved a third party. When a firm stores client files with a cloud provider, a document-management vendor, or a file-transfer service, that vendor's security becomes the firm's security. Goodwin Procter's 2021 breach reached its clients through a compromised third-party file-transfer tool — not through anything the firm itself did wrong at the keyboard.

The new variable: generative AI

Layered on top of these familiar vectors is a genuinely new one. As lawyers and staff adopt generative-AI tools, a quiet confidentiality risk has opened up: employees pasting confidential client information into public AI tools that may retain it, train on it, or surface it elsewhere. Independent vendor research consistently estimates that something on the order of 10–13% of prompts to public AI tools contain sensitive organizational data. The cautionary tale everyone now cites is the 2023 incident in which Samsung engineers leaked proprietary source code and internal notes into ChatGPT, prompting a company-wide ban — but the same exposure exists every time a paralegal drops a confidential draft into a consumer chatbot to "clean it up."

AI is also sharpening the older threats. AI-generated phishing is more convincing and easier to produce at scale, and deepfake-enabled fraud has already produced eight-figure losses elsewhere in the economy. The tools that make a small firm more productive are, without governance, also widening the ways it can be compromised.

Why this is a leadership issue, not an IT issue

It would be comfortable to file all of this under "something for our IT vendor to handle." That instinct is the deeper risk. As we'll see in Part 2, the duty to safeguard client information sits squarely on the lawyers — not on a managed-services provider — and the legal and ethical consequences of a breach are now well defined. The firms that fare best are not the ones with the biggest security budgets; they're the ones whose leadership treats data protection as a governance responsibility and can show the reasonable steps they took.

That last point — being able to show your work — turns out to be the entire game. Before we get to why, it helps to understand exactly what a breach now triggers under the rules you already practice under.

Next in the series — Part 2: How a Data Breach Reshapes Your Ethical and Legal Exposure. We'll walk through the ABA Model Rules and Formal Opinions 477R, 483, and 512 that now govern data security and AI use, and the regulatory and civil-liability machinery that switches on the moment client data is exposed.

A note on getting ahead of this. Most firms don't need a bigger security budget so much as a clear-eyed assessment of where they actually stand. An AI Governance Phase 0 Assessment inventories your data, tools, vendors, and current safeguards against the standard you're held to — and produces the gap analysis everything else is built on. If you'd like to know where your firm sits, that's where the conversation starts.

This article is for general information and is not legal advice. Figures are drawn from the ABA Cybersecurity TechReport, the Verizon Data Breach Investigations Report, and FBI/IC3 publications; sources are available on request.