A successful SRG intrusion exposes a law firm's most sensitive assets: client identities, litigation strategy, settlement negotiations, and financial records covered by attorney-client privilege. Extortion leverage is high because disclosure of a breach may itself constitute an ethical violation, creating pressure to pay rather than report. Regulatory exposure is significant under state bar rules, GDPR where EU clients are involved, and applicable data breach notification laws, with reputational harm to client relationships that can take years to rebuild.
You Are Affected If
Your firm employs reception or administrative staff who interact with walk-in visitors or external IT vendors without formal verification procedures
Systems containing client files, case databases, or financial records are accessible from physical workstations in common or semi-public areas
MFA is not enforced on remote access, email, or document management systems (CIS 6.3, CIS 6.4)
Visitor and physical access logs are not reviewed or correlated with system authentication events
Employee security awareness training does not include scenarios for in-person social engineering or impersonation attempts
Board Talking Points
FBI has warned that a known extortion group is physically entering law firms to steal privileged client data and use it as leverage — this is not a remote-only threat.
Immediate actions include enforcing multi-factor authentication on all client-data systems and conducting a physical access audit within the next two weeks.
Firms that do not address physical access controls and employee verification procedures remain at elevated risk of extortion that may not be defensible without disclosure.
ABA Model Rules (1.1, 1.6) — law firms have professional competence and confidentiality obligations covering client data; a breach may constitute an ethical violation requiring bar notification
GDPR — firms holding data on EU-based clients are subject to breach notification requirements within 72 hours of discovery
State data breach notification laws — personally identifiable information held in client files triggers notification obligations in most U.S. jurisdictions