Public Library
Incident playbooks for law firms.
First-hour decisions, then ABA Model Rules, Formal Opinion 483, and state breach-notification triggers, then the longer-arc cleanup. Written for the firm administrator at 8:00am.
Showing 12 of 12 playbooks
Trust-account / IOLTA wire fraud
A spoofed email changed the wire instructions on a settlement or closing. Money has moved. The next 72 hours are the whole game.
Read playbook →Business email compromise — impersonation
Opposing counsel, the client, or a vendor isn't who they appear to be. A new mailbox rule is quietly forwarding privileged threads.
Read playbook →Ransomware mid-litigation
The document-management system is encrypted and a motion is due at noon. The court will not move the deadline because you were hacked.
Read playbook →Practice-management or document-management vendor compromise
Clio, NetDocuments, iManage, or your DMS vendor has the incident. The firm is still responsible to the client.
Read playbook →Stolen or lost device with privileged data
A laptop in a hotel, a phone in a cab, a banker's box in a car. The question is whether you can prove it was encrypted.
Read playbook →Insider — departing attorney or staff
The lawyer who left took the client list. Or staff snooped in a high-profile matter.
Read playbook →Client portal / e-signature account takeover
Stolen client credentials on the firm portal or DocuSign. The attacker may now be the client, for purposes of redirecting a disbursement.
Read playbook →New-matter intake / conflicts-check phishing
The intake inbox is the least-locked-down mailbox in the firm — and it's where credential theft starts.
Read playbook →E-filing / court-system credential compromise
PACER or state e-filing credentials are in the wrong hands. Fraudulent filings or sealed-matter surveillance are now possible.
Read playbook →Co-counsel, e-discovery, or vendor breach
Someone else holding your client's data has had the incident. Your residual duty doesn't end at their door.
Read playbook →Cyber insurance, LPL, and bar-counsel response
Once the dust settles, the duties start. ABA Opinion 483 has no safe harbor.
Read playbook →Outside Counsel Guidelines / client security-audit failure
A major client sent a security addendum the firm can't meet. The engagement is now at risk.
Read playbook →