The Debt Defense Law firm was the unfortunate victim of a burglary when hard drives and backups were stolen from its Coral Gables office.

Firm attorney Erik Kardatzke reported the loss 11 days later to the state attorney general's privacy bureau. He estimated 1,426 credit card numbers and some driver's license copies may have been taken in the 2015 break-in. Kardatzke reported the breach in compliance with state law and attached a consumer notification.

In the realm of data breaches, the loss was small, but it was one of more than 100 security incidents reported by firms from Big Law to solo offices to state authorities in the last five years, according to public records, cybersecurity experts and interviews.

Debt Defense Law was the only Florida firm to report a breach. Kardatzke responded by email to say he considered his firm's breach atypical. In response, he said, "My innovations were an alarm system and a camera outside my door."

Based on extensive public record requests, Law.com identified dozens of firms that reported data breaches in 14 states that could have exposed personal information.

Am Law 200 firms Jenner & Block, Jones Day, McDermott Will & Emery, Proskauer Rose and Squire Patton Boggs were affected. Also falling victim to reported data breaches were Harris Beach, McGlinchey Stafford and other midsize firms, prominent boutiques such as Sanford Heisler Sharp as well as solo practitioners, nonprofits, government law offices and law schools.

State-by-state differences in reporting requirements make it difficult to discern definitive trends, but phishing attacks and other external breaches, such as hacking and vendor leaks, represented the largest share of cybersecurity breaches identified in Law.com's investigation.

Click the image to see which law firms reported breaches.

Despite a number of high-profile breaches putting firms on notice of cyber risks in recent years, there are indications that law firm breaches are occurring more frequently, not less.

Some cybersecurity lawyers and consultants say the reports likely represent a tiny fraction of the breaches affecting the legal industry. Law firms, like other privately held businesses, don't often publicize breaches, and many may not report it to state officials, depending on the law.

Austin Berglas, global head of professional services at cybersecurity company BlueVoyant and former head of the FBI's cyber branch in New York, said law firms are a top target because of the client information they possess.

"They are a one-stop shop," Berglas said. And because law firm success is often tied to their reputation for preserving attorney-client privilege, they may be more willing to pay hackers off if they fall victim to ransomware, he added.

"Law firms are only going to make those reports when they've confirmed through a forensic investigation that reportable information has been touched. They're not going to report every event, every spearfishing campaign — they see it every day," Berglas said.

Breaching the Experts

Overall, disclosures by law firms and lawyers accounted for only a small fraction of the hundreds of data breach notifications that Law.com reviewed. Businesses ranging from accountants and restaurants to financial services firms and Trump hotels have notified state regulators that they may have been victims.

But the evidence of widespread legal industry breaches is striking because lawyers have a duty to protect privileged client information. And many law firms, particularly Am Law 200 firms, advertise themselves as experts in cybersecurity that advise clients on how to prevent and limit data breaches.

Austin Berglas, former head of the FBI's cyber branch in New York, called law firms "a one-stop shop" for hackers. (Courtesy photo)

Proskauer Rose has also been both a counselor and a victim. The New York firm, which bills itself as a "recognized leader in privacy and cybersecurity law," has submitted data breach reports on behalf of Bed Bath & Beyond; Clinton Health Access Initiative; International Quality & Productivity Center; GAM Fund Management Ltd. and jeweler Harry Winston, according to documents obtained by Law.com.

In 2016, Proskauer disclosed its own data breach to state authorities, after it "received several reports from firm employees that tax returns were filed in their names by unauthorized individuals in acts of identity theft."

The law firm reported to authorities and affected employees that an employee in its payroll department received a fraudulent email, appearing to be from one of the firm's senior executives, requesting copies of W-2s of firm personnel.

"Believing that the email request was legitimate the payroll employee emailed the requested information," the firm told state officials. "The reply-to email address was fraudulent, and the information was transmitted to an unauthorized third party."

In all, more than 1,500 people were affected, Proskauer said in its New York disclosure. Besides assisting its affected staff members, Proskauer reported it was taking steps to "prevent something like this from happening again," including improving staff training and management controls and placing restrictions on the type of data that is electronically transmitted.

A Proskauer representative declined to comment to Law.com.

Discreet Reporting

All states require businesses to report cybersecurity incidents to people affected by a breach, but some states have minimal or no requirements for reporting to state officials. In the more regulated states, law firms like other businesses must be counted on to self-report.

"Law firms are pretty discreet on how they report" data breaches, said Claudia Rast, Butzel Long's cybersecurity group leader and a member of the American Bar Association's cybersecurity legal task force. "Unfortunately, many law firms don't report it. They don't want their clients to know about it."

Complicating matters, some of the most sensitive client data that law firms possess can be related to mergers and other transactions. But a breach involving details of an M&A deal, if it included corporate data but did not expose personal information, does not necessarily need to be reported to state authorities, according to Rast and others.

Such sensitive deal information was at the heart of a Manhattan federal indictment in 2016 of three Chinese nationals charged with hacking into two major U.S. law firms in a scheme to trade on information about imminent mergers and acquisitions. None was prosecuted. Based on details in the indictment, the two firms appeared to be Weil, Gotshal & Manges and Cravath, Swaine & Moore, firms with cyber breaches that were previously reported in news media.

In another high-profile incident, DLA Piper was hit by a major cyberattack in summer 2017, knocking out phones and computers across the firm, apparently triggered by a ransomware attack. A firm spokesman said, "No client data was taken."

Still, an increasing number of breach reports filed by law firms in the last five years may show both the rising frequency of legal industry data breaches as well as an increasing awareness and compliance on the part of law firms, said lawyers in data privacy practices.

"There's more data breaches [in all industries], but more importantly people are becoming more sophisticated in monitoring" for them, said Avi Gesser, a partner at Davis Polk & Wardwell in its cybersecurity practice. "They're detecting them more, and they're more aware of their notification obligations as the market becomes more forgiving. People get more comfortable reporting. They feel like they are being good corporate citizens."

"If you don't call anybody or tell anybody," he said, "it's hard to play the victim role."

While phishing incidents demonstrate law firms can prepare and train lawyers to prevent some data leaks, other law firms' disclosures obtained by Law.com show some security incidents may be beyond their control.

Some law firms reported data breaches through a vendor's security lapse, while others reported stolen hard drives and laptops, raising the question of whether data breaches are a cost of doing business, even in an industry that so closely guards its information.

"More than half of businesses experience data security incidents," said Claudia Rast, a cybersecurity lawyer at Butzel Long. "Law firms are no different than most businesses out there."

Samantha Stokes contributed to this report.