Key Takeaway

Many cyberattacks no longer look suspicious. Modern phishing emails often appear legitimate and are designed to trick employees into clicking links, opening attachments, or providing login credentials. For businesses and law firms, one mistaken click can lead to ransomware, data breaches, wire fraud, business interruption, and significant financial losses. Cyber liability insurance can help protect against these risks—but understanding your coverage before an incident occurs is critical.

Why Small Businesses and Law Firms Are Prime Targets for Cyberattacks

One of the biggest misconceptions about cybercrime is that hackers only target large corporations.

In reality, small businesses and law firms are targeted every day. According to Gartner research, end-user spending on information security is projected to reach approximately $215 billion globally in 2024, with financial institutions among the industries making the largest cybersecurity investments 

Cybercriminals know that many smaller organizations can’t spend like financial institutions.  They do not have dedicated cybersecurity teams or sophisticated security infrastructure in place. 

They also know that employees are busy, moving quickly, and often handling large volumes of emails, invoices, contracts, and document requests throughout the day.

For law firms specifically, cybercriminals recognize the value of the information attorneys handle, including:

• Confidential client communications
• Financial records
• Settlement information
• Wire instructions
• Personally identifiable information
• Business and litigation documents

Because of this, law firms and professional service businesses have become increasingly attractive targets.

A Real Example of a Modern Phishing Email

Recently, I received a phishing email that looked legitimate at first glance.

The subject line referenced a “Deposit Confirmation Request” and stated that documents were ready for signature. The email used professional formatting and branding that appeared to come from a legitimate business platform.

To someone moving quickly through emails during a normal workday, there would have been very little that immediately stood out as suspicious.

That is exactly what makes these attacks so dangerous today.

Years ago, phishing emails were often easier to identify because they contained obvious spelling errors, poor formatting, or unusual wording. Modern phishing attacks are much more sophisticated. 

Many are carefully designed to resemble everyday business communications.

Common examples include:

• DocuSign requests
• Facebook account cancellations
• Deposit confirmation emails
• Shared document notifications
• Microsoft 365 login alerts
• Invoice requests
• Wire transfer confirmations
• Password reset requests

Cybercriminals understand that employees regularly interact with these types of emails, which increases the likelihood that someone will click without taking a closer look.

What Happens After Someone Clicks a Malicious Link?

Many cyber incidents begin with a simple mistake.

Once an employee clicks a malicious link or opens an infected attachment, several different things can happen depending on the nature of the attack.

Ransomware Attacks

One of the most common outcomes is ransomware. In these situations, hackers lock access to business systems and files until a ransom is paid.

This can bring normal business operations to a halt for days—or even weeks.

Data Breaches

A phishing attack may also allow cybercriminals to access sensitive client or customer information.

For law firms, this can create significant legal, ethical, and reputational concerns.  It takes years to develop a stellar reputation and seconds to destroy it.

Wire Fraud and Financial Theft

Some attacks are designed specifically to compromise banking information or redirect wire transfers. Businesses handling real estate transactions, settlements, or vendor payments are particularly vulnerable. In the legal field, these attacks often target attorneys, paralegals, or office managers involved in client billing, wire transfers, or trust account administration.

Business Interruption

Even when data is recoverable, downtime itself can become extremely expensive. Businesses may lose revenue, productivity, and client trust while systems are being restored.

The Financial Impact of a Cyberattack

The costs associated with a cyber incident often extend far beyond repairing a computer system.

Businesses may face:

• IT forensic investigation costs
• Data recovery expenses
• Lost revenue from downtime
• Legal fees
• Breach notification costs
• Credit monitoring services
• Public relations expenses
• Regulatory penalties
• Increased insurance premiums after a claim

For many small businesses, even a relatively small cyber incident can create serious financial strain.  According to industry research, the average cyberattack on a small or mid-sized business can cost over $250,000 once you factor in downtime, recovery costs, lost revenue, and other expenses. 

Does General Business Insurance Cover Cyberattacks?
One of the most common misunderstandings I see is the assumption that standard business insurance automatically covers cyber-related incidents.

In many cases, it does not.

Some policies may provide very limited protection with small sub-limits, while others exclude cyber-related losses entirely.

That is why cyber liability insurance has become so important.

What Does Cyber Liability Insurance Typically Cover?

Coverage varies depending on the policy, but a properly structured cyber liability policy may help with expenses related to:

Forensic Investigations

Determining how the breach occurred and what systems or information were affected.

Data Recovery

Recovering or restoring compromised systems and files.

Business Interruption

Helping offset lost income during operational downtime.

Legal Expenses

Coverage for certain legal costs associated with a cyber incident.

Breach Notification Costs

Helping businesses comply with legal notification requirements after a data breach.

Ransomware and Extortion Expenses

Some policies may help cover ransomware-related costs depending on the circumstances and policy terms.

Because every business is different, it is important to review policy details carefully and understand what is and is not included.

Cyber Insurance Is Not a Substitute for Cybersecurity

Cyber liability insurance is an important part of risk management—but it should not replace good cybersecurity practices.

Businesses should still implement:

• Employee cybersecurity training
• Multi-factor authentication
• Strong password policies
• Email filtering and spam protection
• Regular software updates
• Reliable data backups
• Reputable IT support

Even with strong systems in place, however, human error remains one of the leading causes of cyber incidents.

And sometimes, all it takes is one click.

Final Thoughts: Review Your Cyber Coverage Before There’s a Problem

The reality is that no business is completely immune from cyber threats anymore.

Modern phishing emails are becoming increasingly convincing, and cybercriminals continue to target businesses of all sizes—including law firms and professional service providers.

Understanding your cyber risks—and your insurance coverage—before an incident occurs can make a significant difference in how disruptive and expensive a cyber event becomes.

If you are unsure whether your current policy adequately addresses cyber risks, it may be worth reviewing your coverage now rather than waiting until after a problem occurs.

When I review insurance policies for law firms, there’s one issue I see come up again and again…cyber liability.

And more often than not, the conversation starts the same way:

“We already have cyber coverage.”

That may be true. But the real question is… what does that coverage actually include?

Because in many cases, when we take a closer look, there are some significant gaps.

The Problem Isn’t Whether You Have Coverage—It’s What It Covers

I recently reviewed a policy for a small law firm. Smart attorneys, well-run practice, and they were confident they had everything in place from an insurance standpoint.

On the surface, it looked like they had cyber coverage.

But once we dug into the details, the picture changed.

There was no coverage for social engineering fraud.
Wire transfer fraud protection was missing.
Business interruption coverage was minimal.
And the deductible was set so high that it would take a major incident before the policy even became useful.

This isn’t unusual. Many cyber policies are written in a way that appears comprehensive, but when you read the fine print, certain types of claims are carved out, capped, or excluded altogether.

Why Law Firms Are a Target

Law firms are in a unique position when it comes to cyber risk.

You’re handling sensitive client information.
You’re moving money.
You’re constantly communicating via email.

That combination makes law firms an attractive target for cybercriminals.

And unlike large financial institutions, most firms don’t have the same level of cybersecurity infrastructure or internal controls in place. That doesn’t mean firms are careless—it just means they’re often easier to exploit.

All it takes is one convincing email.
One request that looks legitimate.
One click.

From there, a situation can escalate quickly—sometimes into a six- or even seven-figure loss.

Where Cyber Policies Often Fall Short

This is where things get tricky.

A policy might say “cyber coverage,” but that doesn’t always mean you’re protected in the ways you expect.

Some of the most common gaps I see include:

• Social engineering fraud – when someone impersonates a trusted party to trick you into sending money
• Funds transfer fraud – unauthorized movement of money through your systems
• Ransomware payments – coverage limits or conditions that don’t fully address real-world scenarios
• Business interruption – limited protection for lost income if your systems are down

In many cases, these areas are either excluded entirely or subject to strict sublimits that may not go very far in an actual event.

A Better Question to Ask

If you’re a law firm owner, I’d encourage you to shift the way you think about cyber insurance.

Instead of asking:

“Do we have cyber coverage?”

Ask:

“What exactly is covered, where are the gaps and can we afford that risk?”

That’s where the real value is.

Because with cyber liability, what you don’t know can end up being the most expensive part.

Final Thought From Don I, Your Insurance Guy

Cyber risk isn’t going away. If anything, it’s becoming more sophisticated and more targeted.

The goal isn’t to overcomplicate things or create unnecessary concern—it’s simply to make sure you understand what you have in place before you need it.

If you’re unsure, it’s worth taking a closer look.

Sometimes a quick review can uncover small adjustments that make a big difference.

About the Author

Don I helps law firms and small businesses understand their insurance coverage so there are no surprises when it matters most. If you’d like a second set of eyes on your policy, he’s always happy to provide straightforward, no-pressure feedback.

If you’re planning to retire, step away from private practice, or transition out of law for any reason, there’s one topic you cannot afford to misunderstand: extended reporting periods, often referred to as “tail coverage.”

Recently, I read an article published on the Professional Liability Underwriting Society blog, authored by Lucas Roberts, that does an excellent job of reinforcing an important—and often overlooked—point about tail coverage. It’s a point worth emphasizing because getting it wrong can leave you exposed at exactly the wrong time.

What an Extended Reporting Period Really Does

Many attorneys assume that purchasing tail coverage (or qualifying for a free tail) automatically protects them from any issues that arise after their policy ends. That assumption can be dangerous.

An extended reporting period does not extend the time to report claims you already know about.

Instead, it allows you to report claims that are first made against you and first become known to you during the extended reporting period—after your policy has ended.

That distinction matters.

Known Claims Must Be Reported Before You Tail Out

Before canceling your policy or requesting tail coverage, you must take the time to review your files carefully. Any claim—or even a potential claim—that you are aware of must be reported to your carrier before the policy ends.

This is true whether you are:

• Purchasing tail coverage, or
• Qualifying for a free tail under your policy

Failing to report known issues before tailing out can result in a claim being denied later due to late reporting—even if you have an extended reporting period in place.

Why This Step Is So Important

Here’s the situation you want to avoid:

You retire or leave practice.
You tail out your policy.
A claim surfaces during the extended reporting period.
You report it—only to learn that the carrier declines coverage because the issue was known before the policy ended and was never reported.

At that point, you may find yourself personally responsible for a claim you assumed was covered.

The Right Way to Protect Yourself

Before you tail out:

1. Review your open and closed files carefully
2. Identify any actual or potential claims
3. Report those issues to your carrier before canceling the policy
4. Then proceed with tail coverage—free or purchased

Taking these steps helps ensure that the coverage you believe you have is actually there when you need it.

Final Thoughts

Extended reporting periods are a valuable protection—but only when they’re understood and used correctly. Don’t let a technical misunderstanding undo years of careful risk management.

If you’re approaching retirement or considering a transition out of practice, now is the time to review your coverage and make sure everything is handled properly.

Cyber insurance is still one of the most misunderstood types of coverage I see — especially among law firms.

Many firms assume they’re protected…
until something actually happens.

Unfortunately, that’s often when they discover the coverage they thought they had doesn’t respond the way they expected. Let’s clear up some of the most common cyber insurance myths law firms continue to believe.

Myth #1: “Our General Liability Policy Covers Cyber Incidents”

This is one of the most common — and most dangerous — assumptions.

In most cases, general liability insurance does not cover cyber incidents.
General liability is designed for things like bodily injury, property damage, or advertising injury — not data breaches, ransomware, or network intrusions.

If a client’s personal information is compromised, a general liability policy typically won’t respond. That’s where cyber insurance comes in — if you have it set up correctly.

Myth #2: “We Have an IT Company, So We Don’t Need Cyber Insurance”

IT support is critical — but it’s not a substitute for insurance.

Think of it this way:

• IT helps prevent problems
  
• Insurance responds when prevention fails
  

Even the best security systems can be bypassed. Phishing emails, compromised passwords, vendor breaches, and human error still happen every day. When they do, cyber insurance helps cover the financial fallout — not your IT provider.

Myth #3: “We’re Too Small to Be a Target”

This one couldn’t be further from the truth.

Today, size doesn’t matter when it comes to cyber attacks. In fact, smaller law firms are often easier targets:

• Less money spent on cybersecurity
  
• Fewer internal controls
  
• Outdated systems
  
• Easier access points for attackers
  

Hackers aren’t always looking for the biggest payout — they’re looking for the path of least resistance.

Myth #4: “Cyber Insurance Is Just for Ransomware”

Ransomware may get the headlines, but cyber insurance covers much more than that.

Depending on the policy, cyber coverage may help with:

• Data breaches
  
• Business interruption
  
• Client notification requirements
  
• Forensic investigations
  
• Legal and regulatory costs
  
• Credit monitoring services
  
• Crisis management and reputation support
  

Cyber incidents can affect your firm long after systems are restored — and the costs add up quickly.

The Real Issue: Understanding What Cyber Insurance Does (and Doesn’t) Cover

The biggest issue isn’t whether a law firm has cyber insurance.

It’s whether they understand:

• What their policy actually covers
  
• What it excludes
  
• How it would respond in a real-world incident
  

If you’re not sure how your policy would work during a data breach or cyber attack, that’s usually a sign it’s worth reviewing.

Every January, I see the same insurance mistake. And it usually doesn’t show up until there’s a problem.

It’s not that people don’t have insurance. Most do. The issue is the assumption that because a policy renewed, the coverage must still be right for the business. Unfortunately, that assumption can be costly.

Renewed Doesn’t Always Mean Reviewed

Most insurance policies renew automatically. That convenience is helpful, but it can also be misleading. A renewal doesn’t necessarily mean anyone reviewed your coverage. In many cases, it simply means the paperwork rolled over from the previous year.

The challenge is that businesses don’t stay the same from year to year.

Over the course of twelve months, you may hire employees, take on new types of clients, rely more heavily on technology, or store more sensitive data. Each of those changes can affect your risk. But unless someone actually looks at the policy, your coverage remains exactly where it was.

Where Problems Often Appear

I’ve seen situations where someone believed they were fully covered — and technically, they were. Just not for the situation they were facing.

The issue usually isn’t negligence. It’s the assumption that “renewed” meant “reviewed.” When a claim happens, that’s not the time anyone wants to discover that something changed and the policy didn’t keep up. At that point, the decision has already been made.

Why January Is the Right Time to Look

The start of the year is actually a good time to pause and ask a simple question: does my insurance still match how my business operates today?

That doesn’t automatically mean you need more coverage. In many cases, it simply means you need the right coverage for how your business has evolved.

A short review at the beginning of the year can help identify gaps, outdated limits, or assumptions that no longer apply. More importantly, it can prevent an expensive surprise later.

A Small Step That Can Make a Big Difference

Insurance is designed to protect you when something unexpected happens. Making sure your coverage reflects how your business actually operates is one of the simplest ways to make sure it does what it’s supposed to do.

A little time spent reviewing things now can go a long way toward avoiding problems later — and that’s something I’d always rather help people prevent.