It's customary for law firms to list their lawyers' email addresses online to allow prospective clients to contact an attorney. But do these public listings also lead to a heightened risk of cyberattacks?

Some cybersecurity professionals have argued that the benefits of placing lawyers' email addresses online can outweigh potential risks—if lawyers are equipped with the proper training.

“Once a threat actor has targets in mind, they will often send malicious emails to attorneys with lures related to new or existing client matters,” explained Charles Carmakal, vice president of cybersecurity platform FireEye. “The emails typically contain links to websites that attempt to collect credentials or malicious attachments that deploy backdoors on victim computers.”

Carmakal said removing email addresses from a law firm's website to prevent targeted attacks may “possibly slow down the attacker by a little bit … [but] it's easy to guess an email address,” because many organizations follow a consistent format.

Indeed, the benefits of posting lawyers' email addresses online outweigh the risks, Carmakal and others said.

“I don't know how lawyers can function without their email addresses being publicly available,” said Chicago-based Hinshaw & Culbertson partner and security officer Steven Puiszis.

Instead of removing their email addresses, Puiszis recommended that lawyers not post too much information on social media.

“One of the things I tell people is, the more information you post about yourself or family members on social media, the easier it is for a hacker to craft an email that seems to come from someone you know or trust,” Puiszis said.

Some also suggested cybersecurity exercises and training to protect lawyers' data. “[It's] not dangerous or inappropriate to put your name out there, but you have to train your employees to look out for certain things,” said David Lipscomb, an IT professional and president of BDPA Philadelphia, an organization seeking to connect diverse IT and science, technology, engineering and mathematics (STEM) professionals to development programs.

“I think what happens is most people need to be educated by their IT team or general counsel,” Lipscomb said.

Lipscomb cited the American Bar Association's technology competency rule that states, in part, “to maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.” Ongoing cybersecurity training and assistance may fulfill that requirement, Lipscomb said.

Since the ABA added that rule of professional conduct in 2012, many state bars have adopted it with mixed competency results. Alaska and Montana were the most recent states to add such a requirement, according to LawSites.