A Firm Can Restore Its Data and Still Lose Client Confidence

A law firm's most valuable asset isn't on the balance sheet. It's the confidence clients have when they hand over information they'd show to almost nobody else.

The campaign I wrote about last week shows attackers are willing to go after it directly.

SOCRadar recently reported a campaign attributed to INC Ransom that created individualized public websites for twenty-four U.S. law firms, each claiming to possess information about their clients and showing a countdown to publication, likely shared with the client. A traditional leak site resides on the dark web and requires specialized software to visit. An ordinary website is accessible by everyone and can be shared in a text message.

The distinction is the whole strategy. Instead of leaving the negotiation to occur between attacker and firm, this approach attempts to recruit the firm's own clients into pressuring them.

The attacker speaks first

Prior to an incident, the firm knows comparatively little. Investigators are working to determine how access was gained, which systems or applications were accessed, whether data exfiltration occurred, and when systems can return to operations. These are slow-burning questions with concrete answers.

An attacker has none of these constraints. They provide their statement immediately, with full assurance.

If clients hear from the attacker first, the attacker has already selected what the event is. Even hyperbolic language has damaging potential, since a client attempting to assess their exposure has no ability to judge their own risk.

What makes this worse is the firm's tendency to wait and speak only when it has comprehensive information. This is understandable but is a costly position to occupy. Silence conveys unpreparedness, even when the firm is taking precisely the right actions behind closed doors in accordance with counsel and forensic investigations.

Communication is a control, not an afterthought

Most incident response plans I've seen treat client communication as an afterthought. In a client-directed extortion event, that sequencing doesn't work.

This is not an argument for releasing premature statements. It is an argument for creating a process for releasing accurate statements quickly as facts become known.

Practically, that means establishing ahead of time:

Who is going to coordinate communications, and who needs to approve a statement before it's released (not a committee assembled on the fly).

How leadership will communicate if email is compromised (most incident response plans assume the opposite).

Which clients need to be contacted first. A generic communication isn't sufficient for all matters. Leadership should already know which engagements are at risk of missing deadlines, contain trust funds, sensitive records, or involve individuals at greater risk.

How client inquiries should be escalated, so a client doesn't get three different responses from three different attorneys in the same afternoon.

There's also a fraud mitigation angle that firms often overlook. Once criminal actors possess client contact information, they impersonate the firm itself, directing payments or settlements to new accounts or requesting additional information that the legitimate firm would never collect. Clients should be briefed in advance on how the firm authenticates requests for instructions, because those assurances are less valuable in the middle of the incident.

Credibility is built before the incident

A response plan can't manufacture credibility in a week. What does earn credibility is proving that the firm took concrete steps to identify foreseeable risks, assign responsibilities, test and exercise its response, train its staff, and mitigate known weaknesses ahead of time.

That record has value beyond the incident response itself. The same evidence bolsters client communications while supporting communications with insurers and regulators that often follow.

That's why this training isn't exclusive to the people who maintain technology. Receptionists, legal assistants, paralegals, accounting, and attorneys all end up playing a role in the response. None of them need technical expertise, but each must be able to recognize a suspicious request, know the reporting procedures, avoid speculation, and have an urgent question directed to the right person.

The same goes for vendors. Most firms outsource hosted document storage, cloud email, billing, e-discovery, and managed IT to third parties. If nobody knows who is supposed to raise an issue or who is contractually responsible for what, leadership loses critical hours at the most critical hour.

The question I'd put to firm leadership

You can rebuild a server from a backup. Rebuilding a client's confidence takes significantly longer and is a non-technical process.

Readiness shouldn't be measured, in part, by the ability to respond to the technology failure itself.

Does your incident response plan explain how you will protect client relationships during an incident, or is it assumed to be resolved when the technology is restored?

---

Sources: SOCRadar: INC Ransom Targeted 24 Law Firms, but Only 10 are Listed; Halcyon: INC Ransom Group Mounts Rapid Campaign Against Law Firms