In February 2017, tax forms for hundreds of current and former Jenner & Block employees fell in the wrong hands, potentially exposing their private addresses, Social Security numbers and salary information.

The law firm described the breach as a phishing incident, telling New York officials that files containing employees' W-2 forms were "mistakenly transmitted to an unauthorized recipient in response to what was believed to be a legitimate request from management."

In all, the breach may have exposed the personal information of 859 people, according to Jenner's report to state authorities.

That breach, previously unreported in the news media, was just one of dozens of cybersecurity incidents that law firms—from Big Law firms to solo offices—have reported to state authorities in the last five years, according to public records, interviews with affected firms, and cybersecurity experts.

While Jenner's breach ostensibly only affected its own attorneys and employees, many other law firm breaches may have leaked confidential client information, reports to state officials show. Based on extensive public record requests, Law.com identified more than 100 law firms that have reported data breaches to authorities across 14 states since 2014, notifying authorities that a data breach affecting the firm could have exposed individuals' personal information.

Besides Jenner, Am Law 100 firm Proskauer Rose was also affected. Also falling victim to reported data breaches were Harris Beach, McGlinchey Stafford and other midsize firms; prominent boutiques such as Sanford Heisler Sharp; as well as solo practitioners, nonprofits and government law offices. Several law schools also reported breaches (as did ALM, Law.com's parent company).

Differences in reporting requirements across states make it difficult to discern definitive trends, but phishing attacks and other external breaches, such as hacking and vendor leaks, represented the largest share of the data breaches identified in Law.com's investigation.

Click the image to see which law firms have reported breaches.

Despite a number of high-profile breaches putting firms on notice of cyber risks in recent years, there are indications that law firm breaches are occurring more frequently, not less.

For instance, in New York state, the number of unique law firm data breaches doubled to eight in 2018 from four the previous year, affecting nearly 1,500 individuals, according to reports submitted by the firms.

Some cybersecurity lawyers and consultants said the reports likely represent a tiny fraction of the breaches affecting the legal industry. Law firms, like other privately held businesses, don't often publicize when their data is breached, and many may not report it to state officials, depending on the law.

Austin Berglas, former head of the FBI's cyber branch in New York and now global head of professional services at cybersecurity company BlueVoyant, said law firms are a top target among hackers because of the client information they possess.

"They are a one-stop shop," Berglas said. And because law firm success is often tied to their reputation for preserving attorney-client privilege, they may be more willing to pay hackers off if they fall victim to ransomware, he added.

"Law firms are only going to make those [data breach] reports when they've confirmed through a forensic investigation that reportable information has been touched. They're not going to report every event, every spearfishing campaign—they see it every day," Berglas said.

Breaching the Experts

Overall, disclosures by law firms and lawyers accounted for only a small fraction of the hundreds of data breach notifications that Law.com reviewed. Businesses ranging from accountants and restaurants to financial services firms to Trump hotels have notified state regulators that they may have been victims.

But the evidence of widespread legal industry breaches is striking because lawyers have a duty to protect privileged client information. And many law firms, particularly Am Law 200 firms, advertise themselves as experts in cybersecurity that advise clients on how to prevent and limit data breaches.

Some firms that market themselves as savvy in cybersecurity have been victims themselves. Jenner, for example, maintains a data privacy and cybersecurity practice for "counseling and litigation services to ensure the privacy and integrity of their sensitive information." In 2017, the same year Jenner reported its own phishing incident, the law firm informed state authorities of several data breaches on behalf of corporations such as Revlon Consumer Products, McKinsey & Co. and Scientific Games Corp.

In a statement to Law.com about its data breach, Jenner said the firm "complied with all legal and reporting requirements, and provided assistance to any affected personnel." The firm added that it "takes data security very seriously and maintains a rigorous and systematic approach to information security which includes technical, administrative and physical safeguards designed to protect client and other information." The firm added that it operates a "formal, documented, externally audited information security management system designed to protect firm and client data."

Austin Berglas, former head of the FBI's cyber branch in New York, called law firms "a one-stop shop" for hackers. (Courtesy photo)

Proskauer Rose has also been both a counselor and a victim. The New York firm, which bills itself as a "recognized leader in privacy and cybersecurity law," has submitted data breach reports on behalf of Bed Bath & Beyond; Clinton Health Access Initiative; International Quality & Productivity Center; GAM Fund Management Limited; and Harry Winston, according to documents obtained by Law.com.

In 2016, Proskauer disclosed its own data breach to state authorities, after it "received several reports from firm employees that tax returns were filed in their names by unauthorized individuals in acts of identity theft."

The law firm reported to authorities and affected employees that an employee in its payroll department received a fraudulent email, appearing to be from one of the firm's senior executives, requesting copies of W-2s of firm personnel.

"Believing that the email request was legitimate," the firm told state officials, "the payroll employee emailed the requested information. The reply-to email address was fraudulent and the information was transmitted to an unauthorized third party."

In all, more than 1,500 people were affected, Proskauer said in its New York disclosure, including 700 state residents. Besides assisting its affected staff members, Proskauer reported that it was taking steps to "prevent something like this from happening again," including improving staff training and management controls and placing restrictions on the type of data that is electronically transmitted.

A Proskauer representative declined to comment to Law.com.

Discreet Reporting

All states require businesses to report cybersecurity incidents to individuals affected by the breach, but some states have minimal or no requirements for reporting to state officials. In the more regulated states, law firms, like other businesses, must be counted on to self-report.

"Law firms are pretty discreet on how they report" data breaches, said Claudia Rast, Butzel Long's cybersecurity group leader and a member of the American Bar Association's cybersecurity legal task force. "Unfortunately, many law firms don't report it. They don't want their clients to know about it."

Complicating matters, some of the most sensitive client data that law firms possess can be related to mergers and other transactions. But a breach involving details of an M&A deal, if it included corporate data but did not expose an individual's personal information, does not necessarily need to be reported to state authorities, according to Rast and others.