What Cybersecurity Practices Are Bar Associations and Clients Now Requiring of Law Firms?

In April 2026, Jones Day confirmed a phishing attack gave an unauthorized party access to files for 10 clients, and the Silent Ransom Group, a threat actor the FBI says has targeted law firms since 2023, claimed responsibility (Reuters). Bar regulators and corporate clients no longer treat incidents like that as a private IT problem. Here is what firms are now expected to have in place, and where the requirements come from.

The headline insight

Law firm cybersecurity moved from best practice to enforceable obligation on three fronts at once, and they reinforce each other. Bar ethics rules now specify what "reasonable efforts" to protect client data means in practice. A majority of states require lawyers to understand the technology risks in their own practice as a matter of competence, not choice. And corporate clients, especially banks, insurers, and defense contractors, have converted their own regulatory obligations into contractual security requirements they impose on outside counsel. A firm that treats any one of these as satisfied by the others is usually wrong, because each imposes a different standard, a different notification clock, and a different enforcement mechanism.

Why it matters now

Three trends are converging in 2026 that make this more than a compliance memo exercise. First, law firms are a named target, not incidental collateral. The FBI has circulated notices that the Silent Ransom Group has targeted law firms specifically since 2023 "likely due to the highly sensitive nature of legal industry data," and Jones Day's April 2026 incident followed a similar breach at Williams & Connolly, where hackers accessed a "small number" of attorney email accounts (Reuters).

Second, the economics are getting worse. BakerHostetler's 2026 Data Security Incident Response Report, based on more than 1,250 incidents it helped clients manage in 2025, found the average initial ransomware demand rose 70% to $4.2 million and the average payment rose 36% to $682,702. Litigation followed more often too: class actions were filed in 14% of 2025 incidents, up from 9% in 2024 (BakerHostetler 2026 DSIR Report).

Third, regulators will force disclosure firms would rather avoid. In July 2023, a federal court ordered Covington & Burling to give the SEC the identities of seven of nearly 300 clients whose files were exposed, so the SEC could check whether those public companies had disclosure duties of their own (SEC v. Covington & Burling, LLP, cited in NYC Bar Formal Opinion 2024-3). Confidentiality duties do not automatically shield a firm from that kind of order.

What changed: three sources of obligation, not one

1. Bar ethics rules now describe specific conduct, not just principles

ABA Model Rule 1.6(c) requires a lawyer to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." For a decade that language left firms to guess at what "reasonable efforts" meant. The New York City Bar's Formal Opinion 2024-3, issued July 18, 2024, is the most detailed state-level guidance to date on that duty during an actual incident. It holds that lawyers must understand the technology they use, monitor for incidents, investigate promptly, and take reasonable steps to mitigate harm, and that vendors handling client data must meet compatible standards under Rules 5.1 and 5.3. It also answers questions firms face mid-crisis: notification to current clients is governed by Rule 1.4 and does not extend to former or prospective clients by default; there is no ethical prohibition on paying a ransom, and none requiring it either; and firms may withhold candor from a cyber-extortionist about facts like insurance coverage, because "public policy and societal good are best served by thwarting the success of cyber-extortionists" (NYC Bar Formal Opinion 2024-3). At the national level, ABA Formal Opinion 483 (October 17, 2018) remains the baseline for what lawyers owe clients after an electronic data breach, requiring notice to current clients under Rule 1.4 once a breach involves, or is substantially likely to involve, material client confidential information.

2. Technology competence is now a licensing requirement in most states

In 2012 the ABA amended Comment 8 to Model Rule 1.1 to say a lawyer "should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology." As of September 2026, 40 states plus D.C. and Puerto Rico have formally adopted that duty, most recently Puerto Rico (effective January 2026) and D.C. (approved April 2025) (LawNext Tech Competence Tracker). New York goes further: the NYC Bar opinion notes New York lawyers have been required, since a 2023 CLE rule, to complete one hour of cybersecurity training every two years. A firm operating across jurisdictions cannot assume one training program satisfies every state's version of this duty, since a few states, including California, addressed the same substance through an ethics opinion rather than a formal rule amendment.

3. Corporate clients are writing their own security requirements into engagement terms

Outside Counsel Guidelines, the terms a corporate client attaches to an engagement, have carried information-security sections since the Association of Corporate Counsel released its Model Information Protection and Security Controls for Outside Counsel in March 2017, intended as "a benchmark for law firm cybersecurity practices" (ACC press release). What changed is how specific and enforced those sections have become. Banks, insurers, and defense contractors now push their own regulatory obligations into the OCG itself: encryption standards, breach-notification SLAs measured in hours rather than the "prompt" standard bar rules use, MFA mandates, and post-matter data-destruction timelines. For firms doing DIB-adjacent work, this mirrors the flow-down obligations subcontractors owe under DFARS 252.204-7012, just imposed through an engagement letter instead of a subcontract.

What firms should do this quarter

1. Separate the three clocks. Build an incident playbook that tracks bar-ethics notification duties (Rule 1.4, no fixed deadline but "prompt"), statutory breach-notification deadlines (which vary by state and can run in days), and OCG-specified SLAs (often the shortest of the three) as distinct triggers, not one combined checklist.
2. Inventory what your OCGs actually require. Pull the security sections from your ten largest engagements and compare them against current controls. Gaps most often show up in encryption at rest, MFA enforcement, and post-matter data destruction commitments.
3. Hold vendors to the Rule 5.3 standard. The 2023 MOVEit incident that compromised hundreds of organizations, including law firms, was a vendor vulnerability, and NYC Bar Formal Opinion 2024-3 makes clear "reasonable efforts" under Rule 5.3 extend to file-transfer, e-discovery, and case-management vendors.
4. Assume you are a named target. With ransomware groups specifically targeting the legal sector since 2023, after-hours monitoring matters more for a firm than a typical mid-market business, since extortion is often timed around deadlines and closings.
5. Write down your ransom-payment decision process before you need it. Ethics rules permit but do not require payment, and the decision involves OFAC screening, client-consent questions, and conflicts analysis.

Metrics to track

• Mean time to detect and contain a confirmed intrusion, benchmarked against your plan's stated targets, not industry averages alone.
• Percentage of active OCGs reviewed in the last 12 months for security-term changes.
• Vendor security assessment completion rate across file-sharing, e-discovery, and practice-management platforms.
• Phishing simulation click and report rates, tracked by office and practice group.
• Cyber insurance sublimits for ransomware, checked against benchmarks like BakerHostetler's $4.2 million average initial demand.

Open questions we're watching

Whether more states move beyond ethics opinions to codify affirmative, program-level security requirements for law firms, closer to a financial-services model than a professional-conduct model, is unsettled. So is whether courts keep siding with regulators the way the D.C. district court did in SEC v. Covington & Burling, which would make client-identity confidentiality a weaker shield in the next major incident than many firms assume.

Where Cyberuptive fits

Firms that outsource detection and response still own the ethics and contractual obligations above; a managed SOC or MDR engagement changes how fast you detect and contain an incident, not whether you owe a client notification under Rule 1.4 or an OCG-specified deadline. Cyberuptive's legal industry practice works from this framework when scoping coverage for firms. For sizing what that coverage should cost, the Managed SOC cost 2026 buyer's guide and the questions to ask before shortlisting an MSSP are useful starting points, and the vendor-risk lessons in how credit unions got hit through their vendors apply just as directly to a firm's file-transfer and e-discovery stack. Firms carrying ransomware coverage should also read how carriers are underwriting ransomware risk in 2026 before assuming a policy written two years ago still matches today's demand figures.

Frequently asked questions

Are law firms legally required to have a cybersecurity program?

Not through a single dedicated statute in most states. The obligation comes from a combination of sources: ABA Model Rule 1.6(c)'s duty to make "reasonable efforts" to prevent unauthorized access to client information, state technology-competence rules, general data-breach notification statutes that apply to any business handling personal data, and, increasingly, security terms written directly into corporate clients' Outside Counsel Guidelines.

What does ABA Model Rule 1.6(c) actually require?

It requires a lawyer to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." It does not list specific technical controls; ethics opinions like NYC Bar Formal Opinion 2024-3 interpret what "reasonable efforts" means in the context of monitoring, vendor oversight, and incident response.

How many states require lawyers to stay current on technology risk?

As of September 2026, 40 states plus the District of Columbia and Puerto Rico have formally adopted the duty of technology competence under Comment 8 to Model Rule 1.1, according to the LawNext tracker maintained by legal technology journalist Bob Ambrogi. California has not formally amended its rule but reached a similar conclusion through a state ethics opinion.

What do corporate clients' Outside Counsel Guidelines typically require?

Common terms include encryption of client data at rest and in transit, multifactor authentication for anyone with system access, breach-notification timelines that are often shorter than the "prompt" standard under bar ethics rules, restrictions on which vendors may process client data, and data-destruction requirements after a matter closes.

Does a law firm have to notify clients after a ransomware attack?

Under Rule 1.4, firms generally must notify current clients when an incident compromises, or has a substantial likelihood of compromising, their confidential information, or when the incident materially impairs the firm's ability to represent them. That ethical duty is separate from, and does not substitute for, any statutory or contractual notification obligation that also applies.

Can a law firm ethically pay a ransom to a cyberattacker?

Yes, according to NYC Bar Formal Opinion 2024-3, paying a ransom to recover systems or client information is not itself a violation of the ethics rules, and the firm is treated as the victim rather than the perpetrator. The exception is payment to a sanctioned entity or foreign terrorist organization, which carries separate legal risk under OFAC rules regardless of the ethics analysis.

What cybersecurity training do lawyers need in New York?

New York has required attorneys, since a 2023 continuing legal education rule, to complete one hour of cybersecurity, privacy, or data protection training every two years as part of their broader CLE obligations.

How common are cyberattacks against law firms?

Law firms fall within the "business and professional services" category that BakerHostetler's 2026 Data Security Incident Response Report tracked as 15% of the more than 1,250 incidents the firm helped clients manage in 2025, and the FBI has separately noted that at least one ransomware group has targeted the legal sector specifically since 2023 due to the sensitivity of the data firms hold.