Every lawyer knows the duty of confidentiality. It shapes how you talk about your cases, how you store your files, who gets a key to the records room.
But privileged material doesn’t live in the records room anymore. It lives in email threads. In draft agreements synced to a cloud folder. In deposition transcripts on a paralegal’s laptop and settlement terms on a partner’s phone. The ethical duty didn’t change. The place where you carry it out did. Today, upholding client confidentiality is largely a cybersecurity discipline, and it deserves the same rigor you bring to conflicts checks and trust accounting.
Two ways confidentiality actually breaks
Email compromise. An attacker who gets into one mailbox at your firm can read everything that mailbox has ever handled: settlement discussions, wire instructions, client medical and financial records, strategy memos to co-counsel. Worse, they can send as you. A convincing email from a real firm address, referencing a real matter, asking a client to redirect a payment: that is the ordinary attack pattern, not a hypothetical one. The confidentiality breach and the financial loss arrive together.
Ransomware. The old understanding of ransomware was an encryption problem: your files are locked, you restore from backup, you lose a bad week. The current version is a confidentiality problem. Attackers copy your files out before they encrypt them, then threaten to publish. A firm that restores every byte from backup has still had its clients’ privileged material taken by a hostile party, and now has notification obligations, malpractice exposure, and a very hard set of client phone calls.
Notice what both failure modes have in common: neither one cares how good a lawyer you are. They care whether a password was reused, whether a sign-in from an unfamiliar country got challenged, whether anyone was watching.
What the duty looks like in practice
Protecting privileged material is not one product; it is a posture, maintained continuously:
– Prove who’s signing in. Multi-factor authentication on email and document systems, with sign-in monitoring that challenges the login that doesn’t fit. – Limit the blast radius. Staff access matter files on a need-to-know basis, so one compromised account doesn’t expose every client the firm has. – Encrypt what travels and what rests. Laptops, phones, email in transit, files at rest: a lost device should be an inconvenience, not a disclosure. – Watch for the quiet signs. Managed detection that flags mailbox forwarding rules, unusual data movement, and sign-in patterns a busy practice would never notice on its own. – Rehearse the bad day. A tested response plan and isolated backups, so an incident is a contained event with a script, not an improvisation.
None of this makes a firm breach-proof; no honest provider will tell you otherwise. What it does is sharply reduce the ways in, and make sure that when something is attempted, someone is positioned to catch it and own the response.
Trust is the practice
Clients hand law firms the things they cannot afford to have exposed. That trust is the practice, and today your systems carry as much of it as your people do. Treating security as the foundation under everything else isn’t an IT preference; it’s the modern shape of a duty the profession has always had.
Lambert Technology Solutions works with Chicago-area law firms as a fixed-fee technology partner, security first. If you’d like an honest read on where your firm’s confidentiality posture actually stands, that conversation is free.