NetworkDefender
NetworkDefender
Wacks Law Group, a six-attorney estate planning firm in Whippany, New Jersey, detected ransomware on its network on March 9, 2024. The Qilin group encrypted their systems and walked out with Social Security numbers, driver's licenses, and confidential case files. The firm did not notify the people affected until August, five months later. That delay alone triggered a class-action lawsuit, on top of a breach that legal industry analysts estimate cost the firm two to three million dollars.
Six attorneys. Not a mega-firm, not a household name. Just a small practice that held the kind of data every law firm holds, and that turned out to be enough.
If you run a small or mid-sized law firm in Wisconsin, that story should get your attention, because the same conditions exist here. This post covers why law firms have become one of the most heavily targeted industries in the country, what recent cases reveal about how these attacks actually play out, what your ethical obligations to clients require, and a concrete incident response plan you can put in place before you need it.
Ransomware groups pick targets the way any business picks customers: by looking for the best return on effort. Law firms score well on every measure that matters to a criminal.
Start with the data itself. A law firm's files can include Social Security numbers, financial account details, medical records, trade secrets, unreleased merger terms, and litigation strategy, often for several clients in a single case file. Recorded Future has tracked attackers spending weeks inside law firm networks before triggering an extortion event, using that time to work out which files carry the most leverage before they lock anything down.
That leverage matters because firms feel pressure to pay quickly. A locked case management system means missed filing deadlines, stalled closings, and clients who can't be served. Halcyon researchers have pointed to exactly this combination when explaining why law firms are attractive targets: sensitive client data, regulatory pressure to resolve incidents fast, and a perceived willingness to pay to protect attorney-client privilege.
Confidentiality itself becomes a weapon in the attacker's hands. For most businesses, a data leak is embarrassing. For a law firm, it can mean a breach of the very duty the client hired you to uphold, so attackers threatening to publish privileged material are threatening every client relationship in that file room, not just the firm's own data.
Meanwhile, the defenses often haven't kept pace with what's being defended. Many small and mid-sized firms run on email, shared drives, and a practice management tool, without anyone dedicated to security. That gap between the value of the data and the strength of the defense is exactly what ransomware operators look for.
And a firm's exposure doesn't stop at its own walls. A firm handling M&A work, insurance defense, or government contracts sits inside other organizations' supply chains, so compromising the firm can be a path to compromising the client too.
These aren't hypothetical risks, and the numbers back that up. Baker & Hostetler's Data Security Incident Response Report found the firm's own team handled more than 30 law firm incidents in 2024. In 2025, that number nearly doubled, and the firm's total caseload across all industries topped 1,250 incidents.
The FBI has taken notice too. In May 2025, it issued a Private Industry Notification about a group known as Silent Ransom Group, which breaks into firm networks through callback phishing and fake IT help desk calls rather than traditional malware. Reporting on the group's activity through 2026 has tracked dozens of U.S. law firms whose data was posted publicly after they refused to pay, and the group has told researchers that most firms it targets do pay.
Some of these attacks come in waves. In March 2026, a group called INC Ransom claimed ten law firms on its leak site within a single 48-hour window, a pace that suggests attackers had compromised a shared technology vendor and used that one point of access to hit multiple firms at once. It's a useful reminder that a firm's exposure isn't limited to its own systems. It extends to every vendor and remote-access tool with a connection into the network.
The financial cost tracks with all of this. Industry research puts the average cost of a law firm data breach at just over five million dollars, a figure that's climbed more than 10 percent year over year, and ransom demands from groups actively hitting the legal sector have run well into six and seven figures.
None of these cases involved a firm with hundreds of attorneys. Small and mid-sized practices are squarely in the crosshairs, because they carry the same sensitive data as larger firms with fewer resources to defend it.
Wisconsin law firms carry a specific duty here that goes beyond general business best practice. Under SCR 20:1.6(d), a lawyer must make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. That language sits in the binding rule text, not a comment, which makes it a disciplinable obligation, not just guidance. Note that it covers inadvertent disclosure too, so a misconfigured backup or an unpatched server can put you crosswise with the rule even though nobody at the firm did anything deliberate.
Two more duties follow directly from that rule when an incident happens. SCR 20:1.4 requires you to keep clients reasonably informed, which is the basis for telling affected clients their information was exposed. And Wisconsin's breach notification statute, Wis. Stat. § 134.98, gives you no more than 45 days to notify affected individuals once you know their personal information was accessed without authorization. Wisconsin exempts entities that already comply with GLBA's federal notification requirements, which is why CPA and tax preparation firms usually follow the federal path instead. Most law firms don't get that exemption, because after the D.C. Circuit's 2005 decision in American Bar Association v. FTC, which held the FTC had no authority to regulate the practice of law under GLBA, firms practicing law generally fall outside the statute's definition of a "financial institution." The 45-day clock applies to you directly.
We've written a full breakdown of the rules, ethics opinions, and federal overlays that apply to Wisconsin law firms, including what ABA Formal Opinion 483 requires of your breach response, in our earlier post on Wisconsin law firm cybersecurity requirements. The short version: the same written incident response plan that keeps you compliant is also the plan that gets you through an actual attack with your license, your malpractice coverage, and your client relationships intact.
Every hour you spend deciding what to do during an active attack is an hour attackers use to spread further and clients wait for answers. Build this plan now, print it, and keep a copy somewhere that doesn't depend on your email being online.
Wisconsin law firms hold data that's worth more, and needed back faster, than what most small businesses handle, and ransomware groups have taken notice. The cases above weren't broken in through sophisticated nation-state tactics. They came in through phishing, help desk scams, and compromised vendors, hitting firms of every size. Your duty under SCR 20:1.6(d) to protect client information doesn't pause because an attack is in progress, and Wisconsin's 45-day notification clock starts the moment you know a breach occurred.
The firms that come through a ransomware attack intact are the ones that had multi-factor authentication in place, tested backups they could actually restore from, and a written response plan with roles assigned before the crisis started. None of that requires an enterprise IT budget. It requires treating your firm's security the same way you'd treat a client's case: documented, current, and ready before you need it.
NetworkDefender Security helps Wisconsin law firms build the security programs, incident response plans, and technical controls that meet their confidentiality and breach-notification obligations, and stand up to an actual attack. Contact us to schedule a security review.