In Part 1, we talked about Verizon’s 2026 Data Breach Investigations Report and why law firms should pay attention to vulnerability exploitation and ransomware.

Now let’s talk about two other issues that are especially important for law firms: the human element and third-party risk.

The human element continues to play a major role in data breaches. The 2026 Verizon report found that the human element was present in 62% of breaches. That does not mean employees are bad. It does not mean lawyers or staff members are careless. It means people are busy, and cybercriminals know how to take advantage of that.

Lawyers, paralegals, office managers, and administrative staff deal with emails, phone calls, text messages, invoices, attachments, wire instructions, document requests, calendar invitations, and client questions all day long. In that environment, one message that looks legitimate can create a serious problem.

And these attacks are not limited to the obvious phishing email with poor grammar and misspelled words. Verizon’s report points out that social engineering is moving beyond email. Attackers are using phone calls, text messages, mobile devices, fake IT support requests, fake vendor communications, and fake client messages. Verizon’s SMB-focused summary also notes that mobile-based phishing simulations had a 40% higher median success rate than email-based simulations.

For law firms, that should get your attention.

A fake wire instruction can lead to a financial loss. A fake password reset can give someone access to your systems. A fake document link can compromise a computer. A fake call from “IT support” can trick someone into sharing access. A fake email that appears to come from a client can start a chain of events that becomes much larger than one message.

So the question should not be, “Does this message look real?”

The better question is, “Did we verify this through a trusted process?”

That is an important distinction. Cybercriminals are trying to create urgency. They want someone to act quickly. They want someone to skip the normal process. That is why law firms need written procedures for payment changes, wire instructions, password resets, file access, and unusual client or vendor requests.

If new wire instructions are received, they should be verified through a known phone number already on file – not the number in the email. If someone requests access to sensitive information, there should be a clear approval process. If someone claims to be from IT support, staff should know how to confirm that request before giving access.

The second issue is third-party risk.

Most law firms rely on outside vendors. That is normal. But it also means your cyber risk is not limited to what happens inside your own office. Verizon’s 2026 report found that breaches involving third parties increased and now account for 48% of breaches.

Think about the vendors that may touch a law firm’s data or systems: IT providers, cloud software companies, case management platforms, document storage systems, billing software, phone providers, payment processors, marketing vendors, and other outside services.

If those vendors have access to your data, your systems, or your credentials, their security matters too.

That does not mean every law firm needs to conduct a full-scale security audit of every vendor. But firms should be asking basic questions before there is a problem.

Do they use multifactor authentication? Do they have written security procedures? Do they carry cyber insurance? What happens if they have a breach involving your data? Who has to notify whom? Who pays for what? How quickly will you know?

Those questions are much easier to ask before something goes wrong.

The same is true for your own cyber insurance coverage.

A law firm should know what its policy actually covers before there is a claim. Does the policy provide coverage for ransomware? Business interruption? Data restoration? Breach response costs? Social engineering fraud? Funds transfer fraud?

Are there sublimits? Are there exclusions? Are there conditions that must be satisfied before coverage applies?

And one of the most important questions is this: did the firm accurately answer the questions on the cyber insurance application?

If the application says the firm has multifactor authentication, but MFA is only being used in some places — or not at all — that can become a very serious issue after a claim. If the application says backups are being performed and tested, but no one has verified that, the firm may have a problem when coverage is needed most.

The lesson from the 2026 Verizon report is not that law firms should panic. It is that law firms should prepare.

Review your procedures. Review your vendors. Review your cyber insurance. Make sure your written practices match what is actually happening inside the firm.

Because when a cyber incident happens, the issue is not only whether your computers can be restored.

The issue is whether your firm can keep operating, protect your clients, meet your obligations, and recover financially.

And the worst time to find out you are not prepared is after the breach.

Law firms are prime targets for wire fraud. 

Attorneys regularly handle sensitive financial transactions involving trust accounts, retainers, settlements, real estate closings, vendor payments, and client funds. That makes law firms attractive to cyber criminals who know that one convincing email can lead to a very expensive mistake.

A typical wire fraud scenario:

It starts with an email that looks legitimate. It may appear to come from a client, a title company, opposing counsel, a vendor, or even someone inside the firm. The email may include a real matter name, familiar language, and wiring instructions that seem reasonable. In some cases, the fraudster has gained access to an actual email account. In other cases, the email address is simply spoofed or altered slightly.

The firm wires the money. Then, after the transfer is complete, someone realizes the instructions were fraudulent.

At that point, the firm has two immediate concerns. 

First, can the money be recovered? 

Second, will insurance cover the loss?

Many attorneys assume that if their firm has cyber liability insurance, a wire fraud loss will automatically be covered. Others assume the loss will fall under crime coverage or lawyers professional liability insurance. Unfortunately, the coverage answer is not always that simple.

Wire fraud can fall into a complicated area between different types of policies. A cyber policy may include coverage for social engineering fraud or funds transfer fraud, but that coverage may be limited by a sublimit. The policy may also include conditions that must be satisfied before coverage applies. For example, the firm may be required to follow specific verification procedures before transferring funds.

A crime policy may also provide coverage in certain situations, but not every fraud scenario fits neatly into the policy language. Lawyers professional liability insurance, meanwhile, is generally designed to respond to professional negligence claims. It should not be treated as a catch-all policy for every financial loss connected to a cyber event.

That is why law firms should not assume they are covered just because they have “cyber insurance” listed on a policy. The details matter.

Firms should review whether their policies address social engineering fraud, fraudulent instruction schemes, and funds transfer fraud. They should also pay close attention to sublimits, exclusions, deductibles, and any required internal controls. A policy may provide a $1 million cyber limit, but the amount available for social engineering fraud could be much lower.

Just as important, the firm’s internal procedures should match the risk.

Email alone should never be enough to change wiring instructions or authorize a transfer. 

If new or revised instructions are received, the firm should verify them using a trusted phone number already on file – not the phone number included in the suspicious email. Any last-minute change, unusual urgency, or request to bypass normal procedures should be treated as a red flag.

Wire fraud prevention is not just an IT issue. It is a law firm management issue, a risk management issue, and an insurance issue.

Before a loss occurs, attorneys should speak with their insurance advisor and review their coverage carefully. The goal is to understand what coverage may apply, what limits are available, and what procedures the firm must follow.

The worst time to discover a gap in coverage is after the money is gone. If your law firm handles wire transfers or client funds, make sure you know how your insurance would respond before a fraud attempt turns into a claim.