Category Archives: Cyber Security

Cyber Insurance Gaps I See Most Often in Law Firms

Posted on by

Cyber insurance has become an important part of risk management for law firms. Data breaches, ransomware attacks, and phishing attempts are now common risks in the legal industry, particularly because firms handle sensitive client information.But one thing I’ve noticed over the years is that many small to mid-sized law firms have cyber insurance coverage that isn’t fully aligned with the risks they actually face.

The issue is usually the details of that insurance policy.

There are several coverage gaps that tend to show up repeatedly when reviewing policies for law firms.

Common Cyber Insurance Gaps Law Firms Should Watch For

While every policy is different, there are a few areas where coverage often falls short. Understanding these gaps can help firms avoid unpleasant surprises if a cyber incident occurs.

Below are some of the most common issues I see.

Inadequate Coverage Limits

One of the most common cyber insurance gaps is insufficient coverage limits.

Cyber incidents can become expensive very quickly. Even a relatively contained incident can involve multiple layers of cost.

Potential Costs of a Cyber Incident

A cyber event may involve:

  • Forensic investigations to determine what happened and how the breach occurred
  • Legal costs associated with responding to the incident
  • Client notification requirements depending on the type of data involved
  • Credit monitoring services for affected clients
  • Business interruption losses if systems are unavailable

For example:

  • A forensic investigation alone can cost $15,000 to $50,000 or more, depending on the complexity of the breach.
  • Credit monitoring services can run up to $30 per person per month for 12–24 months.

When you add those costs together, the financial impact can expand quickly.If a firm’s coverage limit is too low, the policy may still provide assistance—but it may not go nearly as far as the firm expected.

Missing or Limited Social Engineering Coverage

Another gap I often see involves social engineering coverage.Social engineering fraud occurs when someone is tricked into sending money or sensitive information because they believe the request is legitimate.

Examples of Social Engineering in Law Firms

These situations might involve:

  • An email that appears to come from a client
  • A request that looks like it came from a colleague
  • Instructions from what appears to be a trusted partner in a transaction

Because legal transactions often involve sensitive documents and financial transfers, law firms can be particularly vulnerable to these types of scams.

However, not every cyber insurance policy automatically includes strong protection for social engineering losses.In many cases, it requires a specific endorsement or additional coverage to be added to the policy.

Lack of Meaningful Business Interruption Coverage

Business interruption is another area that is sometimes overlooked.

If a cyber incident shuts down a firm’s systems, the consequences can extend far beyond the technical problem itself.

How System Downtime Can Affect a Law Firm

When systems are unavailable, firms may experience:

  • Delayed cases and legal filings
  • Staff unable to access important files
  • Disruptions to normal operations
  • Potentially missed statutes of limitation

Even a temporary disruption can have significant operational and financial consequences.Business interruption coverage is designed to help address these situations. However, not every policy includes this coverage in a meaningful way, and some policies may include limitations that firms don’t realize until after an incident occurs.

High Deductibles That Surprise Firms Later

Another detail that often gets overlooked is the policy deductible.Many firms understandably focus on the coverage limit, but the deductible plays an equally important role in determining how the policy functions.

Why Deductibles Matter

Some cyber policies carry deductibles that are much higher than firms realize.

This means that before the insurance coverage begins responding, the firm may need to absorb a significant portion of the costs themselves.

If that deductible is higher than expected, the financial impact of an incident may be greater than anticipated.

Reviewing this number carefully is an important step in understanding how the policy will actually work in a real-world situation.

Misunderstanding the Retroactive Date

One final detail that deserves attention is the retroactive date.The retroactive date helps determine how far back the policy coverage applies if a breach or cyber incident began before it was discovered.

Why Retroactive Dates Matter

Many cyber incidents are not discovered immediately. In some cases, malicious activity may have started months before anyone realized there was a problem.

The retroactive date helps determine whether that earlier activity is covered.If the retroactive date isn’t fully understood, firms may assume coverage exists when it may not apply in certain situations.

Why These Gaps Happen

It’s important to note that these gaps usually don’t happen because law firms are careless.

In most cases, the issue is simply that:

  • Cyber insurance has evolved rapidly in recent years
  • Policy language can be complex
  • Coverage options can vary significantly between insurers

As a result, many firms end up with policies that made sense when they were purchased—but may not fully reflect how the firm operates today.

Reviewing Your Cyber Insurance Coverage

Because cyber risks continue to evolve, it’s helpful for law firms to periodically review their cyber insurance policies.

A simple policy review can help answer important questions such as:

  • Are the coverage limits still appropriate?
  • Does the policy include social engineering protection?
  • Is there meaningful business interruption coverage?
  • Are the deductibles reasonable?
  • Do we fully understand the retroactive date?

Often, a short conversation can clarify many of these details and help firms feel more confident about the protection they have in place.

Final Thoughts

Cyber insurance has become a critical component of risk management for modern law firms.

However, having coverage isn’t always the same as having the right coverage.

Taking the time to review the details of a policy can help ensure that the protection in place truly aligns with the risks law firms face today.

Want Help Reviewing Your Policy?

If you’re not sure how your cyber insurance policy would respond in a real-world incident, it may be worth taking a closer look.Give INF a call at 412-563-2106 and we can review the key areas discussed in this article to make sure your firm has coverage that’s right for you.

I’m Don I. Your Insurance Guy.

Stay Safe Online This Cyber Monday

Posted on by

With the colder weather comes one of the busiest times of year: the holiday season.

Thanksgiving is up next, and right after that comes a day everyone seems to love (maybe a little too much): Cyber Monday. It’s the day when people jump online, click every button in sight, and buy all the things — whether they really need them or not. It’s fast, it’s fun, and sometimes it’s a little chaotic.

But while you’re online filling your cart, remember this: the bad actors are online too.

Hackers know Cyber Monday brings millions of shoppers to the web, and they work overtime trying to steal valuable information to make their holidays merrier at your expense. That means now is the perfect time to slow down, stay alert, and protect yourself.

How to Stay Safe While Shopping Online

Here are a few things to keep in mind before you click “Buy Now”:

1. Double-check the website you’re on.

Scammers love creating look-alike sites with nearly identical names. Always review the URL carefully before entering any personal or payment information.

2. Be skeptical of emails.

If you get an email about a deal that seems too good to be true, pause. Make sure you recognize the sender, and watch for red flags like misspelled words, weird phrasing, or urgent messages demanding immediate action.

3. Never share sensitive information over email.

No retailer needs your Social Security number, date of birth, or bank account information to confirm a purchase. If someone asks you for it, it’s a scam — full stop.

4. Avoid clicking links you weren’t expecting.

One careless click can lead to malware, viruses, or even ransomware. When in doubt, visit the retailer’s website directly instead of using email links.

Protect Your Holidays

Cyber Monday should be fun — not something that ruins your holiday season. A few extra seconds of caution now can save you from a whole lot of stress later.

Be careful, stay vigilant, and shop smart.

Why You Should Be Protecting Company Devices This Fall

Posted on by

It’s officially fall. And with fall comes football season. And with football season… comes fantasy football.

While I was at the coffee shop today, I couldn’t help but notice how many people were glued to their phones and laptops — talking about who to start at quarterback, what team to bet on, and furiously updating their lineups.

As I watched, one thought crossed my mind:


How many of those devices are company-issued?

The Overlooked Risk of Company Devices

If you’re an employer — whether you have five employees or five hundred — and you provide laptops or mobile phones for work use, it’s worth asking:

Do you really want your company devices being used for things like fantasy football, online betting, or personal gaming?

Beyond productivity concerns, there’s a serious cybersecurity angle here. Those fantasy sports platforms, betting apps, and community forums aren’t always the most secure. Employees visiting those sites on a work device could be exposing your company’s data to malware, phishing attempts, or data leaks — all while trying to swap out the Green Bay Packers’ defense for the Pittsburgh Steelers’.

Why You Need a Clear Device-Use Policy

If your company doesn’t already have a policy in place outlining what employees can and can’t do on company-issued technology, now’s the time to create one.

A clear, written policy helps:

  • Protect your network from unnecessary exposure.
  • Reduce legal and compliance risks tied to inappropriate or unsafe use.
  • Set expectations so employees know what’s acceptable during work hours (and on work devices).

It doesn’t have to be complicated — just clear, consistent, and enforced.

A Simple Step Toward Stronger Security

As an insurance guy, I’ve seen firsthand how one small oversight — like an unsecured login on a fantasy sports site — can lead to costly consequences for a business.

So while I finish my cup of coffee and enjoy the crisp fall air, here’s my advice:


Take a look at your company’s device-use policy (or create one if it doesn’t exist yet). It’s a small step that can save you from a big headache later.

Until next time — stay smart, stay secure, and enjoy the season.

Cybersecurity Myths Lawyers Still Believe

Posted on by

Even in 2025, many law firms are still making the same dangerous mistake — assuming they’re too small, too secure, or too “tech-savvy” to be hacked.

Spoiler alert: those are myths.

Let’s bust some of the biggest misconceptions about cybersecurity that could be putting your law firm — and your clients — at serious risk.

Myth #1: “Hackers Only Target Big Firms”

Many attorneys believe cybercriminals only go after giant firms with massive case files and deep pockets.

The truth? Small and mid-sized firms are often easier targets because hackers assume your defenses are weaker.

Think about it — stealing just a few real-estate transaction details or trust-account logins can be a huge payday for a cybercriminal.

📊 Did you know?
 43% of all cyberattacks now target small businesses.

If your firm handles sensitive data (and whose doesn’t?), you’re already on the radar.

Myth #2: “Our IT Guy Handles Everything”

Having a good IT professional is important — but cybersecurity isn’t just a tech problem.

It’s a people problem.

Hackers rely on human error — that one employee who clicks a phishing link or opens an infected attachment. Even the most experienced IT team can’t stop someone from making a simple mistake.

That’s why training matters more than technology.

Every member of your staff should know how to spot fake emails, suspicious requests, and signs of a breach before it’s too late.

Myth #3: “The Cloud Keeps Us Safe Automatically”

Cloud storage is convenient — and often more secure than local servers — but it’s not foolproof.

The cloud is only as safe as your settings, passwords, and access controls.

Imagine leaving your office file cabinet unlocked because your building has security cameras. That’s what happens when you rely on the cloud but ignore user permissions or password strength.

✅ A Secure Cloud: Strong passwords, limited access, MFA enabled
❌ An Unsecured Cloud: Shared logins, weak passwords, open access

The difference between the two? One data breach away from disaster.

Myth #4: “It Won’t Happen to Us”

This is the most dangerous myth of all.

Cyberattacks aren’t a question of if — they’re a question of when.

Law firms are prime targets because they handle confidential client data, financial records, and case files that can be exploited or sold.

Every firm, regardless of size or specialty, needs to assume they’re a target and prepare accordingly.

 Don’t wait to react — prepare now.

How to Stay Ahead of Cyber Threats

Now that we’ve busted some myths, here’s how to keep your firm protected:

  • Train your team regularly.
     Make cybersecurity awareness part of your firm’s culture.
  • Use strong passwords and multi-factor authentication.
     A few seconds of inconvenience can prevent months of chaos.
  • Have a response plan.
     Know who to call, what to do, and how to communicate if something goes wrong.

Cybersecurity doesn’t have to be complicated or scary. By staying informed and ditching outdated myths, you can keep your clients, your data, and your reputation secure.

For real-world stories and practical protection strategies, check out Game Over? Not Today! by Don Ivol — a great read for any professional serious about defending their business against modern threats.

Stay smart. Stay safe. And keep busting those myths.

Deepfakes & AI Voice Scams: The Next Wave of Social Engineering

Posted on by

Imagine this…

You get a voicemail from your managing partner instructing you to wire funds immediately to close a deal.
The voice is unmistakably theirs — the same tone, cadence, even the familiar urgency.
You make the transfer… only to discover later that your partner never made the call.

Scary, right?
It’s not science fiction anymore. It’s happening right now — and law firms are among the prime targets.

How AI Is Supercharging Scams

Artificial intelligence is transforming how we work, communicate, and market — but it’s also arming cybercriminals with disturbingly powerful tools.

With just a few seconds of recorded speech — perhaps from a webinar, a YouTube clip, or even a voicemail — scammers can now use deepfake and AI voice cloning technology to recreate someone’s voice almost perfectly.

They use these fake voices to:

  • Call your office pretending to be a partner or client
  • Leave urgent voicemails requesting fund transfers
  • Send recorded messages convincing enough to trick even cautious employees

It’s the next generation of social engineering — and it’s frighteningly effective.

Why Law Firms Are Prime Targets

Law firms make ideal victims for AI-driven scams for several reasons:

  • Large Transactions: From settlements to real estate closings, firms often handle significant sums of money.
  • Public Communication: Many attorneys appear in hearings, interviews, webinars, or firm videos — providing plenty of voice samples to clone.
  • High Trust Environments: Attorneys, clients, and staff rely on established relationships and quick communication. When a familiar voice calls, few people question it.

That combination of accessibility, authority, and trust makes the legal sector especially vulnerable to deepfake and voice-cloning scams.

A Real-World Near Miss

Just a few months ago, a law firm nearly wired hundreds of thousands of dollars after receiving a voicemail that appeared to be from its managing partner. The message was urgent, specific, and completely believable.

Thankfully, a sharp-eyed paralegal hesitated and verified the request through another channel — preventing a catastrophic loss. But many firms aren’t so lucky. The scams are evolving faster than most people realize.

How to Protect Your Firm

The best defense against deepfake and AI voice scams isn’t fear — it’s preparedness.
Here’s how to safeguard your team and clients:

1. Verify Unusual Requests

Never rely on a single voicemail, text, or email — even if it sounds or looks legitimate.
Always confirm any urgent or high-value request in person or by calling a known, verified number.

2. Establish a Firm Policy

Create and enforce a rule such as:

“No wires or major actions without verbal confirmation from two trusted people.”

That simple step can stop most scams before they start.

3. Educate Your Team

Train everyone — attorneys, paralegals, and administrative staff — to recognize that voices and even videos can be faked.
Awareness is the most powerful security tool you have.

4. Limit Public Voice Samples

Be thoughtful about how much of your voice appears online.
When possible, restrict recordings or use watermarking technology to protect sensitive communications.

Deepfakes and AI voice scams represent the next wave of social engineering — but they’re not unbeatable.
By slowing down, verifying information, and building a culture of cybersecurity awareness, your firm can stay one step ahead.

Bonus Resource

For more real-world examples of digital deception and practical tips to protect your business, check out Game Over? Not Today! by Don Ivol — a must-read for any attorney serious about cybersecurity.

Stay Vigilant, Stay Informed

Deepfakes may mimic a voice, but they can’t replace human judgment.
Trust your instincts, double-check requests, and keep your firm — and your clients — safe from the next wave of AI-powered fraud.

The $8.5 Million Mistake: How Real Estate Wire Fraud Can Destroy a Closing Overnight

Posted on by

Your client wires $8.5 million to close on their dream property… but the money never reaches the seller.

Instead, it lands in a criminal’s account — and disappears forever.

This isn’t a thriller or a cautionary tale told at legal seminars.
It’s happening to law firms, title companies, and real estate professionals across the country right now.
And if you’re not taking precautions, it could happen to you.

How Real Estate Wire Fraud Works

Wire fraud schemes are disturbingly simple — and brutally effective.

Hackers infiltrate a lawyer’s or real estate agent’s email account, often by exploiting weak passwords or phishing links.
Once inside, they quietly monitor communication for weeks or even months, studying how you and your clients talk about the transaction.

Then, just days before closing, they strike.

They send your client a fake email — nearly identical to yours — with “updated wiring instructions.” The logo matches. The tone matches. Even the signature block looks right.

Except for one tiny detail:
The email address is off by a single letter.

Example:
Real: lawyer@firm.com
Fake: lawyer@firrn.com

Your client, eager to finalize the deal, follows the instructions and wires the funds — straight into the hacker’s account.
By the time anyone notices, it’s too late.

Why Attorneys Are Prime Targets

Real estate closings are a gold mine for cybercriminals:

  • They involve large sums of money
  • They happen under tight deadlines
  • They require constant communication among buyers, sellers, lenders, agents, and attorneys

When stress is high and time is short, mistakes happen — and hackers count on it.
And when millions vanish, the first question everyone asks is:

“Who’s responsible?”

All too often, the finger points at the attorney.

A 3-Step Plan to Stop Wire Fraud Cold

The good news?
You can prevent most wire fraud attempts with three simple steps.

1. Verify Wiring Instructions by Phone

Before any funds are transferred, have your client call a known, trusted phone number to confirm the wiring details.
Not the number in the email — the one you gave them at the start of the engagement.
Even a 30-second phone call can save millions.

2. Educate Your Clients Early

Make it part of your onboarding process to warn clients about wire fraud.
Tell them exactly what to expect — and what not to.
Use this simple script:

“We will never send you wiring instructions by email without verbal confirmation.”

Setting expectations early can eliminate panic and prevent confusion when scammers strike.

3. Use Secure Communication Tools

Whenever possible, send wiring instructions and sensitive details through encrypted portals instead of email.
Think of it as locking the message in a safe instead of dropping it in an open mailbox.

Final Thoughts

Wire fraud isn’t just a technology problem — it’s a people problem.


Hackers rely on trust, urgency, and human error to make their schemes work.
But by slowing down, verifying, and securing your communication, you can protect your clients, your firm, and your reputation.

Bonus Tip: Want to Learn More?

For more real-world stories about cyber risks facing attorneys, check out Don Ivol’s book Game Over? Not Today!
It’s packed with lessons and strategies to help professionals stay one step ahead of cyber threats.

The Hidden Dangers of Public Wi-Fi for Attorneys

Posted on by

Would you hand your briefcase full of confidential client files to a total stranger at Starbucks?
Probably not.

But every time you hop on public Wi-Fi without protection, that’s basically what you’re doing — without even realizing it.

The Illusion of “Free” Wi-Fi

Public Wi-Fi networks at airports, hotels, and coffee shops seem harmless — even convenient. But here’s the truth: these networks are wide-open doors for cybercriminals.

Hackers can launch what’s known as a “man-in-the-middle” attack, which means they slip between you and the internet, secretly watching everything you send — emails, client documents, and even your login credentials.

It’s like passing your case files through a stranger who reads every page before forwarding it along.

Why Attorneys Are Prime Targets

As an attorney, you handle some of the most sensitive information imaginable — from real-estate transactions and business deals to medical records and trust accounts. A single intercepted email could lead to:

  • A breach of client confidentiality
  • Wire fraud involving client trust accounts
  • Or even a malpractice claim

And let’s face it — your reputation is everything. One careless connection on public Wi-Fi could cost you clients, your credibility, and potentially thousands in damages.

How to Protect Yourself (and Your Clients)

The good news? Protecting yourself doesn’t have to be complicated. Here are three quick ways to stay secure when working remotely:

1. Use a VPN (Virtual Private Network)

A VPN encrypts your connection, locking your data in a secure “briefcase” before it travels online. Even if someone intercepts it, they can’t read it.

2. Use Your Phone’s Hotspot

When possible, connect through your mobile data instead of public Wi-Fi. Your phone’s network is far more secure than that “free coffee shop Wi-Fi.”

3. Double-Check the Network Name

Hackers often set up fake Wi-Fi networks with names like “Free Hotel Wi-Fi” or “Airport Guest.” Always verify the exact network name before connecting — or ask an employee to confirm it.

These small steps make it dramatically harder for cybercriminals to snoop on your information.

Cybersecurity Is Client Protection

Cybersecurity isn’t just about safeguarding your computer — it’s about protecting your clients, your firm, and your reputation.

So the next time you’re working outside the office, take a moment before you connect. A little caution now can save you a massive headache later.

Optional Add-On (for Don’s Book Mention)

For even more cybersecurity tips tailored to law firms, check out Don Ivol’s book, Game Over? Not Today! — your guide to understanding the cyber risks every attorney needs to know.

Trust Your Systems

Posted on by

I just got back from playing a round of golf, and while I had a great time thanks to my playing partner, my actual game was pretty lousy. Like most golfers, on the drive home I caught myself thinking: maybe it’s time for a new putter, a different set of clubs, or a new brand of golf balls.

But then it hit me — my clubs didn’t suddenly get worse in the past two weeks. My golf balls didn’t change. And my putter didn’t lose its magic. The truth was simple: it wasn’t the equipment, it was me.

My tempo was off. I was swinging too fast. I wasn’t focused. And that got me thinking: the same thing happens in business — especially in law firms.

The “Equipment” Problem in Law Firms

When something goes wrong in a firm — a missed statute of limitations, a conflict of interest issue, or a client complaint — our first instinct is often to blame the system.

  • “The calendaring program let us down.”
  • “The conflict checker didn’t catch it.”
  • “We need a better case management tool.”

That knee-jerk reaction leads many attorneys to shop for the “latest and greatest” software. But just like with golf, buying new equipment doesn’t always solve the problem.

It’s Not the Tools, It’s the Process

Before rushing out to invest in new programs, it’s worth asking: Are we using the systems we already have, properly and consistently?

A few examples to consider:

  • Calendaring systems: Are you and your staff updating them daily without fail?
  • Conflict of interest checks: Are all clients, former clients, and ownership interests properly logged?
  • Client documentation: Are you recording every conversation, every update, in the system right away — or are you telling yourself you’ll “do it later” and never getting back to it?

When these steps slip, it’s not the software that failed. It’s the process.

A Weekly (or Bi-Weekly) Check-In

The fix isn’t shiny new tools. It’s discipline. Take a few minutes each week — or at least every two weeks — to sit down with your team and review:

  • Are we updating systems the way we should?
  • Are we putting in accurate, complete information?
  • Are we letting bad habits slide?

Your systems are only as good as the information you feed into them. If you don’t use them consistently, even the most expensive software won’t save you.

Back to the Golf Course

Golf taught me this: you don’t need a brand-new set of clubs every time you have a bad round. You need to slow down, adjust your swing, and focus on the fundamentals.

In the same way, law firms don’t always need new programs when mistakes happen. They need to look inward, review processes, and make sure the team is disciplined in using the systems already in place.

Remember: success isn’t about the latest equipment — it’s about how you use it.

Real-Life Cyber Claim Examples With Don Ivol

Posted on by

Lawyers often ask for proof that cyber events and data mistakes really hit small firms—and what those losses look like in dollars. Below are two real-world claim scenarios to help you see how quickly costs add up and which safeguards (and coverages) matter most.

#1: Shared Office, Shared IT… Total Data Loss

The setup:


A three-lawyer firm subleased space from a larger firm and piggy-backed on the larger firm’s IT. To “separate” data, the small firm was given its own file server (originally used for email).

What went wrong:


The larger firm’s IT admin backed up email, formatted the shared server, and reinstalled software—but forgot to back up the small firm’s files. Result: complete data loss and an operational shutdown while the firm tried to rebuild.

Documented impact:

  • Data restoration expenses: $23,000
  • Lost billable hours: roughly $98,900 (about “$99k” in the narrative)

Why this matters:


Not every disaster is a hacker. Plain old human error and poor segregation of systems can be just as destructive.

How to prevent this (practical steps):

  • Own your backups (don’t rely solely on a landlord’s/host firm’s IT). Use a 3-2-1 backup strategy and test restores.
  • Put clear, written data-segregation and change-management terms in your office/IT agreement.
  • Keep off-network backups (immutable/cloud snapshots) and run recovery drills twice a year.
  • Maintain a simple RPO/RTO target (how much data you can afford to lose/how fast you must be back).

Where insurance can help (policy-dependent):
 Cyber policies with data restoration and business interruption coverage can respond to accidental data loss; some tech E&O or malpractice policies may also come into play depending on facts. Terms vary—review your policy.

#2: Cloud Downgrade → Confidential Case Exposed

The setup:


A firm used a cloud storage provider with two tiers: free and premium. The premium tier kept data private; the free tier made content searchable/downloadable by others.

What went wrong:


The firm missed the renewal. The account reverted to the free tier, quietly exposing the firm’s files online for months. During that window, third parties downloaded details of a sensitive whistleblower matter.

Documented impact (one case):

  • Notification costs: $27,000
  • Defense expenses: $35,000
  • Damages: $2,150,000
  • Fines & penalties: $120,000
  • (Additional client lawsuits were pending and not included in these totals.)

Why this matters:


Most breaches aren’t Hollywood hacks—they’re misconfigurations, missed renewals, or lax vendor settings.

How to prevent this (practical steps):

  • Use auto-renew with multiple payment methods and billing alerts for critical SaaS tools.
  • Enforce least-privilege access, MFA, and default private sharing settings; require approvals for any public link.
  • Turn on configuration monitoring and data-loss prevention (DLP) alerts for exposure of sensitive matter names/IDs.
  • Keep a data map: what you store, where it lives, who can access it, and how long you keep it.

Where insurance can help (policy-dependent):


Cyber policies commonly address privacy liability, regulatory investigations (where insurable), breach response (forensics, notifications, PR), and defense. Coverage for fines/penalties depends on jurisdiction and policy language. Some professional liability (LPL) policies may also respond to alleged ethical violations—review both with your broker.

What These Stories Prove

  • It’s not just “hackers.” Human error and billing lapses can trigger seven-figure exposure.
  • Shared or “free” is risky. If you don’t control the system, you don’t control the risk.
  • Time is money. Even “small” incidents bleed billable hours and momentum.

Insurance is a backstop, not a substitute for sound IT practices.

10-Point Cyber Hygiene Checklist for Small & Mid-Size Firms

  1. 3-2-1 backups with quarterly restore tests
  2. Vendor billing safeguards (auto-pay + backup card + calendar reminders)
  3. MFA everywhere (email, practice management, cloud storage, VPN)
  4. Least-privilege access and quarterly access reviews
  5. Encrypted, private-by-default cloud repositories; ban public links
  6. Patch/update cadence for OS, apps, and network devices
  7. Incident Response Plan with breach-coach contact and a tabletop twice a year
  8. Data map & retention policy (limit what you store; purge on schedule)
  9. Security awareness training (phishing, sharing, and file-handling)
  10. Annual policy review (cyber + LPL) to close obvious gaps

These aren’t edge cases—they’re everyday risks for modern law practices. A few process tweaks plus the right blend of cyber and malpractice coverage can be the difference between an expensive lesson and a swiftly managed incident.

If They Can Breach an Insurance Giant, What’s Stopping Them from Hitting Your Law Firm?

Posted on by

I recently read something eye-opening in an insurance journal — a reminder that cybercrime isn’t just evolving, it’s organizing.

There are now cybercriminal groups that no longer just pick off random companies with weak cybersecurity. Instead, they target entire industries, strategically identifying and exploiting vulnerabilities across the sector. 

One such group is known as Scattered Spider, and their newest target? The insurance industry.

In recent months alone, major players like Philadelphia Insurance Company, Erie Insurance, and Aflac have been hit with significant cyberattacks. These breaches not only disrupted their operations, but in Erie’s case, have already led to multiple class action lawsuits.

Let’s think about that…

These are companies that:

  • Handle sensitive data every day
  • Have risk management baked into their company DNA
  • Invest hundreds of thousands of dollars (if not millions) into cybersecurity infrastructure

… and they still got breached.

So here’s the question every law firm should be asking:

If these highly protected insurance companies aren’t safe, what makes you think your firm is?

The Ugly Truth – Law Firms Are Prime Targets

You might be thinking, “We’re a law firm — not an insurance company. Why would hackers bother with us?”

Here’s why:

  • You store the same type of sensitive data: personal information, financial records, privileged communications.
  • You likely don’t have the same kind of IT budget or internal safeguards that large insurers do.
  • And from a hacker’s perspective, that makes you low-hanging fruit.

Whether you’re a solo practitioner in Pittsburgh or part of a mid-sized firm in Cleveland, you’re exposed — and attackers know it.

The Smart Next Step For Your Firm: Cyber Liability Insurance

Even if you have antivirus software, firewalls, and employee training in place (and you should), there’s another essential layer of protection… 

A tailored cyber liability insurance policy.

This isn’t just about protecting your firm — it’s about protecting your clients and your reputation. A single breach can take down your operations, cost tens of thousands in recovery, and damage your trust with clients.

Cyber policies are more affordable than most firms realize, especially compared to the cost of recovering from an attack.

Want to Learn More?

I go deeper into these risks and solutions in my book, Game Over? Not Today! 

It’s written specifically for professionals like you — attorneys, advisors, and business owners who want to understand the threat landscape and take action before it’s too late.

Pick up my free book today here -> https://bit.ly/INF-Game-Over-Not-Today 

Stop procrastinating. Protect your firm, your data, and your clients.

If you’re in Pennsylvania or Ohio and want to explore your cyber coverage options, I’d be happy to help.

I’m Don Ivol — your insurance guy.