On March 29, I opened my morning iPad and saw a not-very-surprising headline in The Wall Street Journal: “Hackers Breach Law Firms, Including Cravath and Weil Gotshal.” The article does not discuss how the hackers gained access, and no one comments about what information was actually stolen (except for a comment from Cravath that the firm is “not aware that any of the information that may have been accessed has been used improperly”), but law enforcement did not seem surprised that law firms were targets.
You know who is surprised? Law department operations professionals. How do I know? Because, according to the 8th Annual Law Department Operations (LDO) Survey, which we conducted in the summer of 2015, only 7 percent of respondents rated their law firms’ cybersecurity provisions as ineffective in terms of their ability to protect the law department’s data. For comparison sake, 51 percent rated their firms’ provisions as “very effective” or “somewhat effective,” and another 18 percent said they “don’t know.” But it seems only 7 percent saw this coming, despite FBI warnings in 2011 that law firms are viewed as major targets.
