Long aware they've been in hackers' crosshairs, law firms are currently under attack by a new breed of ransomware and attackers.

However, when law firms are hit with a ransomware attack, some are shocked to find out their insurance policies don't include coverage for ransomware payments. Indeed, ransomware is a 21st century business threat that older insurance policies weren't drafted for, observers say.  

While ransomware was once considered a novel intrusion against large enterprises, the cyberattack has become increasingly rampant in all corners of the legal industry.

"It used to be ransomware attacks were rare specialty events that you read about in the newspaper that happened to large corporations," said Joshua Motta, co-founder and CEO of cyber insurance provider Coalition Inc. "At that time I think it was difficult for smaller and midsize companies to relate. Now, they aren't aware of someone that hasn't been affected by ransomware."

Despite growing frequency and awareness of ransomware, some firms may purchase insurance and incorrectly assume ransomware costs and coverage is included.

"The biggest point and perhaps misconception I see with law firms is that they think it's covered under general insurance, but they have to buy specific cyber insurance," Motta said.

Captive insurance, which in the legal industry is an insurance company whose owners and members are all law firms for professional malpractice coverage usually at a lower premium, may also lull members into a false sense of security against ransomware demands, noted Fox Rothschild privacy and data security practice co-chair Mark McCreary.

"Unfortunately a lot of members of those captives see the [policy] will be advertised as cyber insurance," he said. "One of the gaping holes for ransomware is it doesn't pay the ransom. [And] unfortunately a lot of the clients I deal with don't have good backups, and they need to get moving and they see it as being cheaper to pay the ransom."

Though lawyers are meticulous by profession, lawyers can miss details of their own insurance policies, McCreary noted. "They think if they buy an insurance policy and it talks about cyber," it includes ransom payments, he said. "They don't know what they're missing."

To offset not having ransom payment coverage, law firms like Fox Rothschild and other captive insurance members will take out separate cyberinsurance policies from CHUBB, AIG or other insurance providers, McCreary added.

To be sure, paying out of pocket can set law firms back significantly. The average value of ransom demands have grown exponentially since 2017 and it's "not uncommon to see ransom in the millions," Motta said. In turn, law firms are increasing their ransom limits on their cyberinsurance policies to multimillion-dollar losses, Motta added.