500 GB of Privileged Data Stolen. Systems Restored Without Paying.

The Incident

A mid-size law firm providing services across multiple practice areas was hit by a ransomware attack that encrypted its file servers, email systems, and document management platform. The firm's attorneys could not access case files, billing systems, or client communications. Operations stopped.

But the encryption was only half the problem. Before locking the systems, the threat actor exfiltrated approximately 500 GB of data. For a law firm, this is worst-case territory. That data included client matter files, employee HR records, personally identifiable information, and attorney-client privileged materials.

The likely entry point was an unpatched VPN appliance.

The Response

Converge engaged IR panel vendors for digital forensics, legal consultation, and system restoration. The firm was able to restore from backups without paying the ransom demand.

The bigger challenge was the exfiltrated data. A Converge panel vendor reviewed and data mined the full 500 GB to determine exactly what was taken. The findings were significant: client matter files, HR records, and PII were all confirmed among the stolen data.

The insured was required to notify affected clients and employees and provide credit monitoring services. But because of the nature of a law firm's work, this breach carried an additional layer of exposure that most businesses never face. Impacted clients had to be informed that attorney-client privileged information may have been compromised. For some clients, this created potential out-of-pocket costs and downstream liability. This is not just a notification event. It is a threat to the trust relationship that a law firm's entire business depends on.

Multiple state attorneys general opened inquiries into the matter.

The Outcome

Systems were restored from backups. All affected parties were notified and provided credit monitoring. Regulatory inquiries from multiple state AGs are being addressed.

The matter remains open. The firm faces potential liability from clients whose privileged information was exposed, and the total claim cost stands at $350,000 with no clear end in sight.

Key Takeaway

Law firms and professional services companies face heightened exposure because of the nature of the data they hold. A breach that might cost a retailer $66,000 can cost a law firm multiples of that when privileged materials are involved. Patch external-facing infrastructure on a strict cadence, segment sensitive client data from general network access, and implement robust access controls around privileged materials. The attacker got in through an unpatched VPN. One patch could have prevented everything that followed.