When a global law firm pays millions to settle class action suits from clients whose personal information is compromised in a data breach, the price they pay often seems steep. But for a law firm, a multi-million-dollar payout is just the tip of the iceberg when it comes to the damage that can be done by cyber-attacks.

As stewards of some of the most sensitive information on the planet, firms also risk compliance problems, delays that impact legal proceedings, a steep drop in productivity, and severe trust and reputational damage if the firm is breached.

And if it can happen to global firms with thousands of staffers and marquis clients — not to mention significant cybersecurity budgets — it can happen to any firm.