Lawsuits aren't the only threat facing law firms in the aftermath of a data breach. In the event of a cyberincident, lawyers have relevant legal obligations they must follow. And the need to review whether a firm is prepared to meet its ethical obligations is increasingly important, given the number of hacks aimed at lawyers—as reported by Legaltech News, a LogicForce survey found that hacking attempts were made on over 200 U.S. law firms between 2016 and 2017.

Ethics can be especially important for attorneys “in the area of data security, because attorneys can be held liable for data breaches that occur, and part of the standard that the law may apply is the attorney's ethical duty to keep the clients' confidential information secret,” Sean C. Griffin, an attorney at Dykema Gossett who formerly worked at the U.S. Justice Department, told LTN.

Griffin highlighted relevant model rules from the American Bar Association. Under ABA Model Rule 1.6(c), a lawyer needs to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” Similarly, ABA Model Rule 1.15 says “property shall be identified as such and appropriately safeguarded.”