In the past year, there has been a significant increase in the sophistication, severity and frequency of cyberattacks, including high-profile ransomware attacks on major law firms. In response, the U.S. government's FinCEN (Financial Crimes Enforcement Network) issued a warning in the form of its Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments (advisory) available here: https://www.fincen.gov/news/news-releases/fincen-releases-updated-advisory-ransomware-and-use-financial-system-facilitate.

The advisory specifically warns that cyberattacks including ransomware routinely include threats that involve "double-extortion," which means that not only do cybercriminals encrypt a victim's information until they are paid a ransom, but they also threaten to publicly disseminate sensitive files belonging to their victims. As custodians of highly sensitive information, attorneys and law firms of all sizes are especially at-risk for cyber and ransomware attacks because these attacks can create a minefield of conflicting responses and actions to respond to the attack. These include ethical concerns, obligations to notify  current, former and even opposing clients, as well as mandatory applicable reporting requirements that criss-cross a growing list of state-by-state and international reporting laws. And, there is also the ever-present threat of litigation, including class-action litigation.