Engagement Letters, Incident Response and Telling Clients: When a Professional Firm Is Breached

Rule versions described: Idaho Rules of Professional Conduct 1.0, 1.1, 1.4, 1.6, 1.9 and 1.15, Idaho State Bar text current as of March 9, 2026; Idaho Bar Commission Rules Section XIII, current as of March 9, 2026; ABA Formal Opinions 477R (May 22, 2017), 483 (October 17, 2018) and 512 (July 29, 2024); FTC Safeguards Rule, 16 CFR 314.2(m), 314.4(j) and 314.6 (notification amendment effective May 13, 2024); IRS Publication 1345 (Rev. 12-2025); SEC Regulation S-P as amended May 16, 2024 (all covered institutions in compliance by June 3, 2026); Idaho Code 28-51-104 to 28-51-107 as posted by the Idaho Legislature; OFAC ransomware advisory of September 21, 2021. All read October 28, 2026. Rules and opinions change; check the regulator's current text before relying on any point.

When a hardware store is hacked, the questions are about its customers' card numbers. When a law office, a CPA firm or a tax preparer is hacked, the questions are bigger. The firm holds other people's secrets: merger plans, divorce settlements, medical records produced in discovery, tax returns, payroll files, the bank account numbers of every client it has ever served. Some of that material is protected by privilege. Much of it belongs to people who never dealt with the firm at all, such as a client's employees or the opposing party. And the firm's clients chose it because they trusted it to keep those secrets.

This lesson is about the paperwork and the decisions that surround a breach at a professional firm: what the engagement letter should say before anything goes wrong, what corporate clients and insurers will demand, and who must be told what, and when, after something does go wrong. It is written for the managing partner, the office manager, the firm's IT provider and the staff who will be on the phone that first morning, and for clients and reporters who want to know what a firm owes.

It does not repeat the general incident response material that already exists in this training. For the general method (detection, the plan, notice clocks, evidence, forensic firms, law enforcement and tabletop exercises) read Detection, Incident Response and Notification. For backups, recovery targets and how a cyber policy works, read Continuity, Recovery and Cyber Insurance. For a plain-language first-hour guide for any small office, read When Something Goes Wrong. For the statutes, read Breach Notification Laws in All 50 States and Idaho Privacy Law Up Close. This lesson adds what is different when the victim is a firm that owes professional duties to its clients.

Why a breach at a professional firm is different

Three things set a law, accounting or tax firm apart from an ordinary small business when it is breached.

First, there are two sets of duties. Every business that holds Idaho residents' names with Social Security numbers, driver's license numbers or financial account numbers falls under Idaho's breach statute.¹⁰ A law firm also owes its clients a duty of confidentiality under Idaho Rule of Professional Conduct 1.6 and a duty to keep them reasonably informed under Rule 1.4. Those ethics duties cover all "information relating to the representation of a client," not just the handful of data types the statute lists.² A stolen file of deposition transcripts may contain no Social Security numbers at all, so the statute is silent, but the client still needs to know. CPAs carry a parallel professional duty: Idaho's accountancy rules say a licensee "is to protect and not disclose confidential client information" without the client's specific consent.¹¹

Second, the firm holds other people's data. A firm that defends a hospital receives patient records. A firm that handles a company's employment cases holds its employees' personnel files. A tax office holds the dependents' Social Security numbers on every return it prepared. When those files leak, the people affected may never have heard of the firm. That is why, in the Bryan Cave Leighton Paisner case described below, about 53,000 current and former employees of a client sued both the client and its law firm after "a hack of the law firm's network."¹²

Third, the firm is a target because of what it holds. Federal prosecutors in 2016 charged three men with breaking into law firms to read partners' email about pending mergers and trading on it; the U.S. Attorney told law firms that "you are and will be targets of cyber hacking."¹³ Professional firms are also prime targets for wire fraud because they move client money. That subject has its own lesson: Business Email Compromise and Wire Fraud.

How ready are small firms?

Not very, by the profession's own count. The ABA's 2023 Legal Technology Survey, summarized in its 2023 Cybersecurity TechReport (published December 18, 2023, the most recent dedicated cybersecurity edition found), asked lawyers about breaches, plans and insurance:⁸

• 29 percent said their firm had experienced a security breach at some point, up from 27 percent the year before; 19 percent did not know. The survey counted lost or stolen devices, hackers, break-ins and website exploits.
• Only 34 percent said their firm had an incident response plan, down from 42 percent the year before.
• 40 percent reported cyber liability insurance, down from 46 percent in 2022.
• 27 percent had been asked by a client for the firm's security requirements document, 22 percent had been asked to complete a security questionnaire, and 14 percent had a client request an audit or review.

The gap by firm size is the striking part. The firms least able to absorb a week of downtime are the least likely to have a plan.

Before an incident: the engagement letter

An engagement letter is the written agreement that starts most professional relationships: who the client is, what the firm will do, how it will bill. It is also the best place to set security expectations, because it is signed before any sensitive information changes hands and before anyone is under pressure. Clients rarely read the technology paragraph closely, but it matters later: when a client says "you never told me not to email my bank statements," or when a client wires money to an impostor, the letter is the first document anyone looks at.

Why the engagement letter is a security document

For lawyers, several rules point to the engagement letter.

• Rule 1.4, communication. Idaho Rule 1.4(a)(2) requires a lawyer to "reasonably consult with the client about the means by which the client's objectives are to be accomplished," and 1.4(b) requires the lawyer to "explain a matter to the extent reasonably necessary to permit the client to make informed decisions regarding the representation."² How information will travel between lawyer and client is one of those means.
• Rule 1.6(c), reasonable efforts. "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Idaho Comment [19] (the ABA's Comment [18]) adds that "A client may require the lawyer to implement special security measures not required by this Rule or may give informed consent to forgo security measures that would otherwise be required by this Rule."² The engagement letter is where a client's special requirements, or a client's informed choice to accept a less secure method, gets written down.
• Rule 1.0, definitions. "Informed consent" under Rule 1.0(e) means agreement "after the lawyer has communicated adequate information and explanation about the material risks of and reasonably available alternatives." Rule 1.0(n) defines "writing" to include "electronic communications," so consent confirmed by email counts as written.²

For CPAs, the AICPA Code of Professional Conduct, which Idaho's accountancy rules incorporate by reference, is just as direct about outside providers: before disclosing confidential client information to a third-party service provider, "the member should inform the client, preferably in writing, that the member may use a third-party service provider," and if the client objects, the member should not use the provider or should decline the engagement (ET 1.150.040). Routine administrative support such as "record storage, software application hosting, or authorized e-file tax transmittal services" does not need that notice.¹⁴¹¹ The engagement letter is the natural place for that notice.

How the firm will and will not communicate

The ABA's view on ordinary email has changed over time. Formal Opinion 99-413 (March 10, 1999) held that unencrypted email "affords a reasonable expectation of privacy," but added that a lawyer "should consult with the client and follow her instructions" about how to send highly sensitive information.¹⁵ Formal Opinion 477R (May 2017) updated that view: a lawyer "generally may transmit information relating to the representation of a client over the internet" after taking reasonable efforts, but "may be required to take special security precautions" when an agreement with the client or the law requires it, "or when the nature of the information requires a higher degree of security."¹⁶ One of 477R's seven considerations is to "Determine How Electronic Communications About Clients Matters Should Be Protected," which in practice means talking to the client about it.

A communications paragraph usually covers:

• Which channels the firm uses for what. For example: routine scheduling by email; documents with Social Security numbers, bank records or medical information through the firm's secure client portal or encrypted email; nothing sensitive by text message.
• What the firm will never do. Never ask for a password. Never send or change payment instructions by email. Never ask the client to pay by gift card or cryptocurrency. Never send a link to a file-sharing site the client was not expecting without a separate heads-up. The Idaho State Bar warned in April 2024 that scammers were "sending Dropbox links via email with the eventual goal of getting wire transfers for settlement funds."¹⁷ A client who knows what the firm never does can spot a fake.
• Work devices and accounts. ABA Formal Opinion 11-459 (August 4, 2011) says a lawyer ordinarily must warn a client about emailing from "a business device or system" where there is "a significant risk that the communications will be read by the employer or another third party."¹⁸ The letter can ask employee-clients not to use a work email account or a shared family computer for matters about their employer or their household.
• How to verify. A known phone number for the firm, printed in the letter, and the rule that any unusual request should be confirmed by calling that number, not one in the message.

The never-by-email wire instruction warning

The single most valuable sentence in a modern engagement letter is the wire warning: the firm will never send or change wire or payment instructions by email, text or voicemail, and the client must confirm any instructions by calling a known number before sending money. It costs nothing and it addresses the fraud that produces the largest losses. The FBI's Internet Crime Complaint Center counted 24,768 business email compromise complaints in 2025 with losses of $3,046,598,558, and in the report's chart of how BEC victims reported losing money, wire transfer or ACH made up 86 percent.¹⁹ The FBI's own advice is to "Use secondary channels and/or two-factor authentication to verify requests for changes in account information."²⁰

Courts have started to look at whether a firm gave this warning. In McCabe v. Talero (N.Y. Sup. Ct. Queens County, March 31, 2025), home buyers wired about $171,000 to an impostor after their own lawyer's email was hacked. The court denied the buyers summary judgment against the lawyer: there were questions of fact about whether the lawyer should have warned them sooner, and about the buyers' own negligence, because the firm's emails had told them to verify wire instructions by phone.²¹ The warning did not end the case, but it gave the firm a defense. And the ethics side cuts the other way when the firm is the one wiring: the North Carolina State Bar's 2015 Formal Ethics Opinion 6 concluded that a lawyer who disbursed trust funds on spoofed emailed instructions, without calling the seller "at the phone number listed in Lawyer's file," was professionally responsible and "must replace the funds stolen."²² (That opinion is not Idaho law, but it shows how a bar can reason.) Trust account procedures are covered in Trust Accounts and Client Money, and the full fraud pattern in Business Email Compromise and Wire Fraud.

Put the warning in three places, not one: the engagement letter, the signature block of every email from staff who handle money, and a separate reminder sent before each closing or large payment. Fraud tends to strike at the moment money is about to move, often months after the engagement letter was signed.

Encryption and special measures on request

Some clients will ask for more: encrypted email for everything, files only through their own data room, no offshore support staff, no copies on laptops. Formal Opinion 477R treats an "agreement with the client" as one source of a duty to use special precautions, and lists industries where higher-risk information is common: "industrial designs, mergers and acquisitions or trade secrets, and industries like healthcare, banking, defense or education."¹⁶ For sensitive information, 477R says "a lawyer should encrypt the transmission," consider password-protecting attachments, or use "a well vetted and secure third-party cloud based file storage system."

Two practical cautions. First, a firm should not promise a measure it cannot keep. If the letter says "all documents will be encrypted at rest and in transit," every laptop, backup and phone must actually be encrypted, and the promise becomes evidence if they are not. Second, the reverse also happens: a client who refuses the portal and insists on plain email can give informed consent to that choice under Comment [19], and the firm should write down that the client was told the risks and chose the method anyway.²

Cloud services, AI tools and client consent

Using a cloud practice management system or cloud document storage does not, by itself, require client consent under the Idaho rules. Rule 5.3's comments describe "using an Internet-based service to store client information" as ordinary outsourcing that requires reasonable efforts to make sure the vendor's service is compatible with the lawyer's duties.² ABA Formal Opinion 08-451 (August 5, 2008) adds that when outside lawyers or nonlawyers "will be receiving information protected by Rule 1.6," appropriate disclosures should be made and "client consent should be obtained."²³ Vendor review is covered in Client Data, E-Discovery, Cloud and AI and in Vendors, Contracts and Third-Party Risk.

Generative AI is where a general clause is not enough. ABA Formal Opinion 512 (July 29, 2024) says that before a lawyer puts client information into a self-learning AI tool that could disclose it, informed consent is required, and that "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient."²⁴ In plain terms: the engagement letter can tell the client that the firm uses AI tools and describe how, and it can say which tools keep data private by contract, but where real consent is needed it has to be specific enough that the client understands the actual risk of that tool. Opinion 512 also expects lawyers to "read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use," and says AI tools that work like general office equipment are overhead, not a separate charge, unless disclosed in advance.²⁴

Tax preparers have a stricter version of the same idea. Under 26 CFR 301.7216-3, a preparer "may not disclose or use a taxpayer's tax return information prior to obtaining a written consent from the taxpayer," the consent "must be knowing and voluntary," one document cannot authorize both uses and disclosures, and disclosure to a preparer outside the United States needs prior consent.²⁵ A tax engagement letter can mention the firm's providers, but a Section 7216 consent is its own signed and dated document, not a paragraph buried in the engagement terms. Accounting and Tax Firms: GLBA, Safeguards and the IRS covers those consents in detail.

File retention, return and destruction

Old files are breach exposure. A firm cannot lose what it no longer holds. ABA Formal Opinion 483 itself urges data minimization in its footnote 45, and the New York attorney general's 2023 settlement with the Heidell, Pittoni firm (described below) faulted the firm for keeping data it no longer needed.¹²⁶

The rules set minimums, not maximums. Idaho Rule 1.15(a) requires "Complete records" of trust account funds and other property to be "preserved for a period of five years after termination of the representation."² Idaho's accountancy rules require a licensee to return client records on request, "whether the engagement has been terminated or the licensee has been paid for services rendered," in the medium requested if the records exist in that medium; no general workpaper retention period for licensees appears in those rules.¹¹ For tax and accounting firms under the FTC Safeguards Rule, 16 CFR 314.4(c)(6) requires secure disposal of customer information "no later than two years after the last date the information is used" unless it is needed for business or legally required.³

A good retention clause tells the client: how long the firm keeps the file after the matter closes; that the client can ask for the file back during that time; that originals of wills, deeds and similar documents will be returned or held under a separate arrangement; how the file will be destroyed (secure shredding, deletion from systems and, as backups expire, from backups); and that the firm will not send a separate reminder before destruction unless the client asks for one. Litigation holds override destruction schedules, so the clause should say that too.

The client's own security duties

Security runs both ways. A client whose own email is taken over can leak the firm's advice, or can be the channel a fraudster uses to send the firm fake instructions. When courts sort out who bears a wire fraud loss, they often ask which party was in the best position to prevent it. In Beau Townsend Ford Lincoln v. Don Hinds Ford (6th Cir. Nov. 27, 2018), the court said the loss should fall on "the party in the best position to prevent it," and sent the case back for a factfinder to decide.²⁷ An engagement letter can fairly ask the client to:

• tell the firm right away if the client's email, phone or accounts may have been compromised;
• use a personal, not shared or employer, account for the matter where that matters;
• keep portal passwords private and turn on two-step sign-in where the portal offers it;
• verify any payment instructions by phone before sending money, and never act on a change sent by email;
• not forward the firm's advice to people outside the relationship, which can waive privilege.

The letter should frame these as shared expectations, not as a way to shift the firm's own duties onto the client. Rule 1.6(c) still requires the firm's reasonable efforts no matter what the client does.

What each clause is for

The table links each part of a security clause to the rule or source behind it. Accounting and tax firms will find their sources in the right-hand column alongside the law firm ones.

Outside client demands: questionnaires, audits and outside counsel guidelines

Many firms meet security requirements first through their clients, not through a regulator. A bank, a hospital, a public company or a government agency that hires a small firm will often send its own paperwork, and the firm must sign it or lose the work. This section describes that paperwork as it is commonly used in the industry. It is not a recommendation to accept or refuse any particular term.

Security questionnaires and audits

In the ABA's 2023 survey, 22 percent of lawyers said a client had asked them to complete a security questionnaire, 27 percent had been asked for the firm's security requirements document, and 14 percent had a client request an audit or review.⁸ Questionnaires typically ask whether the firm uses multifactor authentication on email and remote access, encrypts laptops and backups, trains staff, has a written incident response plan, tests restores from backup, screens vendors, limits who can see each matter, and carries cyber insurance. Larger questionnaires ask for a SOC 2 report (an outside auditor's report on a service organization's controls against the AICPA's Trust Services Criteria), which few small firms have.¹⁴

Some of these demands come from the client's own regulator. A tax or accounting client that is a "financial institution" under the FTC Safeguards Rule must take "reasonable steps to select and retain service providers" that can protect customer information and must require safeguards by contract (16 CFR 314.4(f)).³ A client that is an SEC-registered investment adviser or broker-dealer must, under amended Regulation S-P, oversee service providers, including requiring them to notify the client "as soon as possible, but no later than 72 hours after becoming aware" of a breach of a customer information system the provider maintains.⁵ A hospital client will send a HIPAA business associate agreement; the health care side is covered in Business Associate Agreements and Vendors.

Outside counsel guidelines from corporate clients

Corporate legal departments commonly issue written "outside counsel guidelines" to every firm they hire. They began as billing rules (no charge for photocopies, staffing limits) and many now include a long security section. As industry practice, these sections commonly include terms such as:

• notice to the client within a short period, often stated in hours, after the firm discovers an incident that may affect the client's data;
• multifactor authentication, encryption of laptops and mobile devices, and encryption of client data in transit;
• limits on which staff may see the client's data, and on storing it outside approved systems or outside the United States;
• approval before the firm uses subcontractors, contract lawyers or new cloud services, and sometimes before it uses generative AI on the client's matters;
• a right for the client to audit or send a questionnaire, and a duty to cooperate in the client's own investigation after an incident;
• return or certified destruction of the client's data at the end of the matter;
• minimum cyber insurance limits, and in some cases indemnity for breach costs.

Two things are worth knowing about these documents. First, a firm that accepts a guideline has made a contract promise, and in many cases a promise that goes beyond the ethics rules. Formal Opinion 477R treats an "agreement with the client" as a source of a duty to take special security precautions, and Rule 1.6 Comment [19] says a client "may require the lawyer to implement special security measures not required by this Rule."¹⁶² Second, a short notice deadline in a guideline is a separate clock from the ethics duty and the statute. A firm with three corporate clients may have three different contract deadlines on top of the legal ones, and its incident response plan should list them.

The reason clients care is visible in the case records. In the Bryan Cave Leighton Paisner breach, the firm and its client Mondelez Global agreed to pay $750,000 to settle claims by about 53,000 Mondelez employees whose data was exposed in the law firm's network; Judge Jorge L. Alonso presided, and the settlement was reported on October 11, 2024.¹² In the MOVEit Transfer attacks of May and June 2023, several large firms were reported among the victims of a flaw in a file-transfer product, which shows that a client's data can leak through the firm's own vendors.²⁸

Answer honestly, and keep the evidence

Every questionnaire and guideline answer is a statement of fact. A firm that checks "yes, MFA on all remote access" when one old server still accepts plain passwords has made a misstatement that can come back after a breach, in a contract claim by the client or a coverage fight with the insurer. The practical habit is simple: have the IT provider confirm each technical answer in writing, keep a folder of evidence (screenshots of MFA settings, the encryption report, the last restore test, training records), and answer "partially" or "in progress, target date [date]" when that is the truth.

Cyber insurance in plain terms

Cyber insurance comes up twice in this lesson: before an incident, when the firm fills out the application, and in the first hour of an incident, when the insurer's hotline may be the first outside call. The general mechanics (first-party and third-party coverage, exclusions, retentions, sublimits, waiting periods) are explained in Continuity, Recovery and Cyber Insurance. What follows is what a professional firm in particular should understand.

What a cyber policy usually covers

In plain terms, a cyber policy usually has two halves. The first-party half pays the firm's own costs: forensic investigators to find out what happened, breach notice letters and call centers, credit monitoring offered to affected people, data restoration, lost income while systems are down, and sometimes extortion payments (subject to the sanctions rules discussed below). The third-party half pays when others make claims against the firm: client lawsuits, class actions, regulatory investigations and, where the law allows, fines.

A professional liability (malpractice) policy is a different policy. It covers claims that the firm made a professional error. Some professional liability policies exclude cyber events or cover them only in part; some cover a client's claim that the firm mishandled wire instructions, and some do not. Social engineering losses, where staff are tricked into sending the firm's own money, are often a separate, smaller "sublimit" within a cyber or crime policy. A firm should know, before anything happens, which policy would respond to a ransomware attack, which to a client's claim over a leaked file, and which, if any, to a fraudulent wire from the trust account. In the ABA's 2023 survey only 40 percent of lawyers reported that their firm had cyber liability insurance.⁸

What underwriters ask

The insurer's underwriter decides whether to offer coverage and at what price, based mostly on the application. Application forms differ by carrier and this module could not verify one standard form, but the questions commonly asked of small professional firms cover:

• Multifactor authentication (MFA) on email, remote access, the practice management system, backups and administrator accounts. ABA Formal Opinion 498 (March 10, 2021) lists "multi-factor authentication to access firm systems" among the tools lawyers should consider.²⁹
• Backups that are separate from the main network (offline, or "immutable," meaning they cannot be changed or deleted for a set period), and how often restores are tested.
• Endpoint detection and response (EDR), meaning security software on each computer that watches for attacker behavior and can isolate a machine, often with a provider monitoring it around the clock.
• Training, especially phishing training, and how often it happens.
• Email security such as filtering and domain authentication, patching speed, the number of records held, whether the firm verifies payment changes by phone, and whether it has a written incident response plan.

The answers are a signed statement of fact. The best-known example of what goes wrong is Travelers v. International Control Services. Travelers sued in the U.S. District Court for the Central District of Illinois on July 6, 2022, alleging that the insured's application said MFA protected email, remote access, servers and other systems, when MFA was used only on the firewall; Travelers asked the court to rescind the $1 million policy and declare no coverage.³⁰ According to the insurance broker Lockton, the insured agreed to a judgment rescinding the policy, entered August 26, 2022, so no court ruled on the merits.³¹ Treat it as an illustration of the risk, not as a holding. The same evidence folder that supports questionnaire answers supports the insurance application.

The insurer's hotline and panel vendors

Most cyber policies have a breach response hotline and a list of approved ("panel") vendors: forensic investigators, breach coaches who coordinate the response, notification and call-center firms, and ransomware negotiators. Policies commonly require prompt notice to the insurer and require the insurer's consent before the firm hires vendors or makes any payment, or the costs may not be covered. That is why the insurer's hotline belongs near the top of the first-hour list, right after stopping the spread.

Two cautions for professional firms. First, the insurer's breach response team works for the insurer's coverage process as well as the firm; the firm's own duties to its clients under the professional rules remain the firm's, and the firm's ethics partner should be in the room for client notice decisions. Second, if the firm's IT provider wants to start wiping and rebuilding machines before the forensic firm arrives, the policy terms and the need to preserve evidence both argue for a short pause to image the affected systems first. Recovery speed matters too, so this is a judgment call that the plan should assign to a named person.

During and after an incident at a law firm

For lawyers, the most specific guidance on breach response is ABA Formal Opinion 483, "Lawyers' Obligations After an Electronic Data Breach or Cyberattack," issued October 17, 2018. ABA opinions are not binding in Idaho; they interpret the ABA Model Rules. But Idaho's Rules 1.1, 1.4, 1.6(c) and 1.9(c) match the Model Rules on these points, and the Idaho State Bar has issued no opinion of its own on data breaches (its ethics committee was suspended in 1994, after issuing its last formal opinion in 1992, and none of the few later opinions addresses technology), so Opinion 483 is the closest written guidance Idaho lawyers have.³²¹

What counts as a data breach under Opinion 483

The opinion uses its own definition, narrower than "anything bad happened" and broader than a breach statute. A data breach is "a data event where material client confidential information is misappropriated, destroyed or otherwise compromised, or where a lawyer's ability to perform the legal services for which the lawyer is hired is significantly impaired by the episode."¹ Two features stand out. It is about material client information, so a stolen laptop that was fully encrypted, or a phishing email that nobody clicked, is not a breach in this sense. And it includes an attack that takes the firm out of service, such as ransomware that locks files during a trial, even if nothing was stolen.

The four duties

Opinion 483 can be read as four duties, in time order.

1. Monitor. Lawyers "must employ reasonable efforts to monitor the technology and office resources connected to the internet, external data sources, and external vendors providing services relating to data."¹ For a small firm that usually means someone, often the IT provider, actually reviews alerts from the email system, endpoint software and backups, and that vendors are required to report incidents to the firm. A firm that learns of its breach from a client, months later, has a monitoring problem.
2. Stop the breach and limit the damage. When a breach is suspected or detected, "Rule 1.1 requires that the lawyer act reasonably and promptly to stop the breach and mitigate damage." The opinion says lawyers "should consider proactively developing an incident response plan."¹ The plan later in this lesson is one way to do that.
3. Find out what happened. "A competent attorney must make reasonable efforts to determine what occurred during the data breach."¹ Which systems, which matters, which clients, whether data left the network, and whether the attacker is still inside. Most small firms need an outside forensic firm for this, usually through the insurer.
4. Tell current clients. When a breach involves, or has "a substantial likelihood of involving, material client information, lawyers have a duty to notify clients of the breach and to take other reasonable steps."¹ The duty rests on Rule 1.4.

The Idaho hooks: Rules 1.1, 1.4 and 1.6

Each of the four duties ties to a rule Idaho has adopted word for word or nearly so.

• Rule 1.1, competence. Idaho Comment [8] says a lawyer should keep abreast of "the benefits and risks associated with relevant technology." Idaho adopted that comment in 2014 (effective July 1, 2014, according to the LawSites tracker).² Responding competently to an incident, and preparing for one, are part of competence. Competence, Confidentiality and Supervision covers this rule in depth.
• Rule 1.4, communication. Idaho 1.4(a)(3) requires a lawyer to "keep the client reasonably informed about the status of the matter," and 1.4(b) to "explain a matter to the extent reasonably necessary to permit the client to make informed decisions regarding the representation."² Opinion 483 grounds breach notice in those two provisions: a client whose secrets may be in a criminal's hands needs to know in order to make decisions about the matter.
• Rule 1.6(c), confidentiality. The duty to make reasonable efforts to prevent unauthorized access. Idaho Comment [19] adds a sentence every firm should know: "The unauthorized access to, or the inadvertent or unauthorized disclosure of, information relating to the representation of a client does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure."² A breach is not automatically an ethics violation. A breach after unreasonable efforts may be. The same comment says that data privacy and breach notification laws are "beyond the scope of these Rules," so complying with Rule 1.6 does not settle the statutory questions, and the reverse is also true.

What the client notice must say, and when

Opinion 483 sets a floor: "the minimum disclosure required to all affected clients under Rule 1.4 is that there has been unauthorized access to or disclosure of their information, or that unauthorized access or disclosure is reasonably suspected of having occurred."¹ The opinion expects lawyers to give enough information for the client to make informed decisions, and to keep the client informed as the investigation learns more. In practice a good client notice says:

• what happened, in plain terms, and when the firm learned of it;
• what kinds of the client's information were or may have been involved, and which matters;
• what the firm has done to stop it and protect the client;
• what the client may want to do (watch for fraudulent payment requests, change passwords used with the firm's portal, consider a credit freeze if personal identifiers were involved);
• who at the firm the client can reach, and how the firm will update the client.

On timing, neither Rule 1.4 nor Opinion 483 sets a number of days. The duty is to keep the client "reasonably informed," and a client whose information may be in a criminal's hands cannot make informed decisions until told, so in practice the notice should come promptly. Waiting for a perfect forensic report is not required, and an early notice that says "we are still investigating" can be updated. Communications should go through a channel the attacker does not control: if the firm's email was the entry point, a phone call or a letter may be the right first contact.

Clients are not all the same. A corporate client with its own security team may need technical details right away, for example the attacker's addresses so it can check its own systems. An individual client in a family law matter may need a phone call more than a letter. A client whose matter involves the opposing party's or a third party's information may need to tell those people too, which can create separate duties under a protective order or a HIPAA business associate agreement.

Ransomware and the notice question

Opinion 483 addresses ransomware directly. Notice is not required if a ransomware attack left no client information "inaccessible for any material amount of time" and the information was not accessed or disclosed. "Conversely, disclosure will be required if material client information was actually or reasonably suspected to have been accessed, disclosed or lost."¹ Modern ransomware groups usually copy data before they encrypt it, then threaten to publish it ("double extortion"), so in most current cases the second sentence applies. Even where nothing left the building, a firm that cannot reach its files for days during active matters may owe clients notice under Rule 1.4 because the attack affects the representation itself, and ABA Formal Opinion 482 (September 19, 2018) on disasters says Rule 1.4 "requires lawyers to take reasonable steps to communicate with clients after a disaster."³³

Former clients

Breaches often reach closed files. Idaho Rule 1.9(c) forbids a lawyer to "reveal information relating to the representation" of a former client except as the rules permit, so the confidentiality duty continues after the representation ends.² Opinion 483 discusses former clients under Rule 1.9(c) and is direct about the limit: the ABA committee said it "is unwilling to require notice to a former client as a matter of legal ethics in the absence of a black letter provision requiring such notice." It added that "data privacy laws, common law duties of care, or contractual arrangements with the former client relating to records retention, may mandate notice to former clients of a data breach," encouraged lawyers to agree with clients at the end of a matter on how their electronic information will be handled and to follow a document retention schedule, and urged firms to limit the data they keep (its footnote 45 ties this to Rule 1.15).¹ So the Rule 1.4 notice duty runs to current clients; for former clients the duty, if any, comes from other law or a contract. The practical answer is the same in most cases anyway: a former client whose Social Security number was in a stolen closed file will receive a statutory notice, and many firms choose to tell former clients whose confidential matters were exposed even where no rule clearly requires it. The engagement letter's retention clause is what keeps this group small.

Does the firm have to tell the bar?

No specific Idaho rule or Idaho State Bar opinion requiring a law firm to report its own data breach to the bar was found in the research for this module. The Idaho Rules of Professional Conduct and the Idaho Bar Commission Rules current as of March 9, 2026 contain no breach-reporting provision, and the Idaho State Bar's list of formal ethics opinions has none on data breaches.²³² Opinion 483 is about notice to clients, not to regulators.

There is one way the bar can learn of an incident automatically. Under Idaho Bar Commission Rule 1307, approved banks must agree to report to Bar Counsel "if any properly payable instrument is presented against a trust account containing funds insufficient to honor the instrument in full, irrespective of whether the instrument is honored." If a fraudulent wire or counterfeit check empties a trust account, the overdraft report goes to Bar Counsel, and under Rule 1308 Bar Counsel asks for a written explanation and six months of trust account statements.³⁴ A firm in that position will be explaining the incident to the bar whether it planned to or not, so its records of what happened and when matter. Trust account fraud is covered in Trust Accounts and Client Money.

Separately, the firm's professional liability insurer will usually require notice of any circumstance that could lead to a claim, and its policy terms, not the bar rules, set that deadline.

Accounting, tax and financial firms after an incident

Accounting and tax firms owe their clients confidentiality under the AICPA Code ("A member in public practice shall not disclose any confidential client information without the specific consent of the client," ET 1.700.001) and under Idaho's accountancy rules, but no Idaho accountancy rule or AICPA interpretation found for this module sets a client breach-notice duty like Opinion 483.¹⁴¹¹ Instead, the clocks for these firms come from federal regulators. The background on who is covered is in Accounting and Tax Firms: GLBA, Safeguards and the IRS; this section is about what happens after an incident.

The FTC: notice within 30 days for 500 or more consumers

Tax preparers and accountants who prepare returns are "financial institutions" under the FTC Safeguards Rule; the rule names them in its examples (16 CFR 314.2(h)(2)(viii)).³⁵ Since May 13, 2024, 16 CFR 314.4(j) has required notice to the FTC of a "notification event" affecting at least 500 consumers.³⁶

• What triggers it. A notification event is "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains." Information is treated as unencrypted if the encryption key was also taken. And unauthorized acquisition "will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition."³⁵ In other words, if an attacker had access, the firm should assume data was taken unless it can show otherwise.
• When. "As soon as possible, and no later than 30 days after discovery of the event." An event is "treated as discovered as of the first day on which such event is known to you," and knowledge of any employee, officer or agent (other than the attacker) counts.³
• How. Electronically, on a form on the FTC's website. The notice includes the firm's name and contact information, the types of information involved, the date or date range if known, the number of consumers affected or potentially affected, a general description, and whether law enforcement has provided a written determination that public notice would impede a criminal investigation or damage national security. Law enforcement may request an initial delay of up to 30 days, which can be extended up to 60 more days on written request.³³⁷
• Small firms are not exempt. The small-entity exception in 16 CFR 314.6 (fewer than 5,000 consumers) excuses the written risk assessment, penetration testing, the written incident response plan and the annual report, but not paragraph (j).³⁸ A small tax office that loses 600 clients' returns must notify the FTC.

The FTC notice is not notice to the clients. Consumer notice comes from state law, discussed below.

The IRS: no later than the next business day

IRS Publication 1345 (Rev. 12-2025), the handbook for authorized IRS e-file providers, includes among its security standards: "Authorized IRS e-file Providers of individual income tax returns must report security incidents to the IRS as soon as possible but not later than the next business day after confirmation of the incident." A reportable incident is "an event that can result in an unauthorized disclosure, misuse, modification, or destruction of taxpayer information." Electronic return originators report through their local IRS liaison for tax professionals, and a provider whose website caused the incident must stop collecting taxpayer information through the site until the problem is fixed.⁴

The IRS's "Data Theft Information for Tax Professionals" page (last reviewed March 26, 2026) lists who a preparer should contact after data theft: the local IRS liaison, who notifies IRS Criminal Investigation ("Speed is critical"); the states, through the Federation of Tax Administrators' "Report a Data Breach" page; the local FBI office; the local Secret Service office "(if directed)"; local police; and the FTC if 500 or more people are affected.³⁹ Publication 4557 adds that for ransomware the firm should "contact the FBI and Cybersecurity and Infrastructure Security Agency (CISA) ... in addition to the IRS," and should contact its insurance company and security experts.⁴⁰

Speed with the IRS protects clients directly: once told, the IRS can watch for fraudulent returns filed with stolen client data and block refunds before they are paid. A firm that waits until clients start getting IRS letters about returns they never filed has lost that chance. The IRS's sample written information security plan, Publication 5708, includes a sample attachment on "Security Breach Procedures and Notifications."⁴¹

State tax agencies

State revenue departments can block fraudulent state refunds the same way. The IRS points preparers to the Federation of Tax Administrators, which routes breach reports to the states.³⁹ An Idaho firm should report to the states where its affected clients file, which for a firm near a border often includes Oregon, Washington, Utah or Montana as well as Idaho. This module did not confirm a separate Idaho State Tax Commission breach-reporting procedure for preparers beyond the Federation of Tax Administrators route; check the Commission's current guidance.

Regulation S-P for SEC-registered firms

Financial advisers and accounting firms with an SEC-registered investment adviser or broker-dealer affiliate fall under amended Regulation S-P, adopted May 16, 2024. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, so the rule now applies to all covered institutions.⁵⁴² Covered institutions must have a written incident response program and must notify affected individuals "as soon as practicable, but not later than 30 days, after becoming aware" that unauthorized access to or use of sensitive customer information has occurred or is reasonably likely to have occurred. Notice is not required if a reasonable investigation determines that the information has not been, and is not reasonably likely to be, used in a way that would result in substantial harm or inconvenience. Service providers must tell the covered institution within 72 hours.⁵

Regulation S-P does not cover CPA firms or law firms as such. But a small firm that serves an SEC-registered adviser is likely to find a 72-hour notice clause in its contract.

Notice rules for every firm: Idaho and the other states

Whatever its profession, a firm that holds personal information about Idaho residents is covered by Idaho Code 28-51-104 to 28-51-107. The statute is summarized in Idaho Privacy Law Up Close; here is what matters most for a professional firm.

Idaho Code 28-51-104 to 28-51-107

• What is covered. "Personal information" means an Idaho resident's first name or first initial and last name combined with a Social Security number; a driver's license or Idaho identification card number; or an account, credit or debit card number together with any required code or password that permits access to a financial account, "when either the name or the data elements are not encrypted." Public government records are excluded.¹⁰ The definition does not include medical information, biometric data, usernames and passwords alone, or taxpayer ID numbers other than Social Security numbers. A tax office's files are full of covered data; a litigation file may have none, which is where the ethics duty does work the statute does not.
• What a breach is. "The illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information for one (1) or more persons." Good-faith access by an employee or agent for business purposes is not a breach if the data is not misused. Paper files are not covered; the statute speaks of computerized data.¹⁰
• Investigate first. A business that becomes aware of a breach must "conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused."⁶
• Then notify, if misuse has occurred or is reasonably likely. Notice goes "as soon as possible to the affected Idaho resident" and "must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach, to identify the individuals affected, and to restore the reasonable integrity of the computerized data system." There is no fixed day count.⁶
• Data held for someone else. A firm that maintains data it does not own (for example, a client's employee files, or a payroll file a bookkeeper processes for a client) must "give notice to and cooperate with the owner or licensee of the information of any breach of the security of the system immediately following discovery" if misuse occurred or is reasonably likely.⁶ This is often the most important clause for professional firms, because the client, not the firm, may own the notice duty to the people affected.
• Law enforcement delay. Notice may be delayed if it would impede a criminal investigation (28-51-105(3)).⁶
• The attorney general. Only public agencies must notify the Idaho attorney general, within 24 hours of discovering a breach. Private firms have no statutory duty to notify the attorney general, though the attorney general is the "primary regulator" that enforces the statute for most private businesses (the Department of Finance and Department of Insurance enforce it for their own licensees).⁶¹⁰
• How notice may be given. In writing, by phone, electronically (consistent with the federal E-SIGN law), or by substitute notice (email, a conspicuous website posting and notice to major statewide media) if notice would cost more than $25,000, more than 50,000 Idaho residents are affected, or contact information is insufficient.¹⁰
• Deemed compliance. A business with its own notice procedures consistent with the statute's timing, or a regulated entity that follows its primary or functional regulator's breach procedures, is deemed compliant (28-51-106).⁴³
• Penalty. "Any agency, individual or commercial entity that intentionally fails to give notice in accordance with section 28-51-105, Idaho Code, shall be subject to a fine of not more than twenty-five thousand dollars ($25,000) per breach of the security of the system" (28-51-107).⁷ The fine is for intentional failure to notify, not for having been breached.

Other states' laws

Breach notice laws follow the person, not the firm. A Boise firm with clients in Oregon, Washington, Utah or Nevada, or a tax office with snowbird clients in Arizona, owes notice under each affected resident's state law, and many states have fixed deadlines, broader definitions (medical data, online credentials) and duties to notify their attorney general or a consumer reporting agency above certain thresholds. All 50 states and the District of Columbia are summarized in Breach Notification Laws in All 50 States. The New York case below shows how this works: an incident at a New York firm affected about 114,979 people, 61,438 of them New Yorkers, and New York's attorney general enforced on behalf of its residents.²⁶

The notice clocks side by side

The chart below lines up the clocks discussed in this lesson. Several can run at once for the same incident.

The notice decision chart: ethics duty, statute or regulator?

After an incident, the firm's ethics partner, managing partner and breach response team usually work through three separate questions. Answering one does not answer the others.

Law enforcement, evidence and ransomware

The FBI and IC3

Report cyber crime to the FBI's Internet Crime Complaint Center at ic3.gov. The FBI's 2025 Internet Crime Report says, "Regardless of the amount lost, file a complaint at www.ic3.gov," and for a fraudulent transfer, "time is of the essence. Immediately, contact your financial institution and request a recall of the funds."¹⁹ The FBI's Recovery Asset Team, working with banks through the Financial Fraud Kill Chain, handled 3,900 incidents in 2025 involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58 percent success rate. Most of those incidents historically began as business email compromise.¹⁹ Idaho residents filed 4,479 complaints with IC3 in 2025, reporting $88,725,284 in losses.¹⁹

Idaho has no FBI field office of its own. The Salt Lake City Field Office covers Idaho through resident agencies in Boise, Coeur d'Alene, Lewiston and Pocatello.⁴⁴ For ransomware, IRS Publication 4557 tells tax professionals to contact both the FBI and CISA.⁴⁰ Law enforcement reporting choices in general are covered in Detection, Incident Response and Notification.

Lawyers sometimes hesitate to report because Rule 1.6 limits what they can reveal. A report about the attack itself (what systems, what time, what the attacker demanded, what bank account the money went to) generally does not require revealing client secrets, and the firm can describe affected data in general terms. Where a client or prospective client is the criminal, ABA Formal Opinion 515 (March 5, 2025) says a lawyer who is the victim of a crime by a client or prospective client "may disclose information relating to the representation to the appropriate authority" to seek investigation and redress, and notes that a scammer posing as a client, with no intent to form a real relationship, was owed no duty at all.⁴⁵

Preserving evidence

The instinct in a small office is to wipe the infected computer and get back to work. That destroys the evidence the firm needs to answer the questions that decide its notice duties: what was taken, from which matters, about which clients. Without logs and images of affected machines, the FTC's presumption that access means acquisition applies, and the firm may have to notify everyone whose data was on the system.³⁵ The New York attorney general's settlement with Heidell, Pittoni required centralized logging with logs accessible for at least 90 days and kept for at least one year, which gives a sense of what a regulator thinks is reasonable.²⁶

The basics for a small firm, which the forensic firm will refine:

• Disconnect affected machines from the network (unplug the cable, turn off Wi-Fi) rather than turning them off, unless the forensic firm or IT provider says otherwise, because memory can hold evidence.
• Do not delete the phishing email, the ransom note or suspicious forwarding rules. Photograph screens.
• Have the IT provider export email audit logs, sign-in logs and firewall logs before they roll over; many cloud services keep them only for a limited time by default.
• Keep a written timeline from the first minute: who noticed what, when, and every decision made and by whom.
• Suspend automatic deletion (email retention rules, backup rotation) so that the evidence and any data subject to a litigation hold are not lost during recovery.

Ransomware and the OFAC sanctions advisory

The Treasury Department's Office of Foreign Assets Control (OFAC) enforces U.S. economic sanctions. Its "Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments," dated September 21, 2021, "updates and supersedes" its October 1, 2020 advisory; a search of treasury.gov on October 28, 2026 found no later ransomware advisory replacing it.⁹ Its main points:

• "The U.S. government strongly discourages all private companies and citizens from paying ransom or extortion demands."
• Paying a ransom to a person or group on a sanctions list can violate sanctions law, and OFAC may impose civil penalties "based on strict liability," meaning a payer can be liable even if it did not know or have reason to know the recipient was sanctioned.
• The advisory reaches those who help victims pay, naming "financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response."
• OFAC treats as significant mitigating factors "a company's self-initiated and complete report of a ransomware attack to law enforcement," made as soon as possible after discovery, and "full and ongoing cooperation with law enforcement." It also counts "meaningful steps taken to reduce the risk of extortion," such as offline backups and incident response plans.
• License applications to make a ransomware payment are reviewed case by case "with a presumption of denial."

Grubman Shire Meiselas & Sacks, the New York entertainment firm attacked in 2020, put the sanctions point in blunt public terms when it refused to pay, saying that "negotiating with or paying ransom to terrorists is a violation of federal criminal law."⁴⁶ That statement was the firm's own characterization; whether a particular payment violates the law depends on who receives it.

The decision whether to pay

This lesson does not tell any firm whether to pay. The decision belongs to the firm's leadership, with its insurer, forensic firm and law enforcement contacts, and it is usually made under extreme time pressure. Here are the considerations as each side states them.

The case firms make for paying. If backups are gone or would take weeks to restore, a decryption key may be the fastest way to serve clients with court deadlines. If the attacker has stolen files and threatens to publish them, a payment may be seen as the only way to reduce harm to clients whose secrets are in the files. Insurers sometimes cover extortion payments, and negotiators sometimes reduce the demand.

The case against paying. The U.S. government strongly discourages it, and sanctions liability is strict. Payment does not guarantee a working key or that stolen data will be deleted; criminals have no enforceable promise to keep. Payment funds further attacks and marks the firm as willing to pay. And, for a professional firm in particular, payment does not end the duty to notify. Under Opinion 483, if material client information was "actually or reasonably suspected to have been accessed, disclosed or lost," clients must be told whether or not the firm paid, and the statutes and the FTC rule turn on acquisition, which a payment cannot undo.¹³⁵

What the evidence shows. The best predictor of having a real choice is preparation: a firm with tested, offline backups can usually restore without the key, and then the only question is the stolen data. That is the point of the backup and recovery material in Continuity, Recovery and Cyber Insurance, and it is why OFAC counts backups and incident response plans as mitigating factors.⁹

An incident response plan for a 5 to 20 person firm

A firm of 5 to 20 people does not need a 60-page plan. It needs a short document that names who decides what, lists the phone numbers, and walks through the first hour, day, week and month. Opinion 483 says lawyers "should consider proactively developing an incident response plan."¹ Tax and accounting firms with 5,000 or more consumers' information must have a written plan covering seven listed areas under 16 CFR 314.4(h); smaller ones are excused from the written plan but still have the FTC notice duty.³³⁸ The general method for writing and testing a plan is in Detection, Incident Response and Notification; what follows adapts it to a professional firm.

Roles: who does what

In a small firm one person may hold two roles. What matters is that each role has a named person and a named backup, and that nobody has to guess who decides.

Outside the firm, the plan should list: the insurer's breach hotline and policy numbers; the bank's fraud line and the name of the firm's banker; the IT provider's emergency number; the FBI resident agency and ic3.gov; the IRS liaison for tax professionals (for e-file providers); and the contact for each client whose contract has a short notice deadline. Print the list. If email and the network are down, a list stored only on the network is no help.

The first hour, day, week and 30 days

The plan, step by step

1. Notice and report inside the firm. Anyone who sees something wrong (a ransom note, files that will not open, a client saying "I got your new wire instructions," an alert from the IT provider) tells the incident lead or technical lead at once, by phone or in person. No one is blamed for reporting.
2. Contain. The technical lead disconnects affected machines from the network, disables compromised accounts, and removes malicious email forwarding rules. Do not pay, wipe or rebuild yet.
3. Call the insurer's hotline. Before hiring outside vendors or making any payment, get the insurer's consent and its panel contacts. Note the claim number and the time of the call.
4. Call the bank if money is involved. Request a recall of any fraudulent wire, freeze further outgoing transfers, and file a complaint at ic3.gov the same day. Speed matters most here.
5. Preserve evidence. Export logs, keep phishing emails and ransom notes, image affected machines as the forensic firm directs, suspend automatic deletion, and keep the decision log.
6. Investigate. The forensic firm determines how the attacker got in, what systems were reached, whether data was copied out and whether the attacker is still present. The ethics partner maps affected systems to clients and matters.
7. Report to regulators on their clocks. IRS e-file providers: the IRS liaison by the next business day after confirmation. Tax firms: the states through the Federation of Tax Administrators. FTC within 30 days if 500 or more consumers. SEC-registered firms: their own Regulation S-P obligations.
8. Decide on client and individual notice. Work through the three questions in the decision chart: ethics duty, statute, regulator. Check protective orders, business associate agreements and client guidelines for their own notice terms. Prepare the notices and a script for staff who answer calls.
9. Recover. Restore from clean backups after the forensic firm confirms the attacker is out. Change all passwords, enforce MFA everywhere, patch the entry point.
10. Learn. Within 30 days of recovery, meet to review what worked and what did not, fix the gaps, update the plan and the engagement letter, and run a short tabletop exercise on the revised plan within the year.

Real incidents at professional firms

Four documented cases show different parts of this lesson: availability, extortion, regulatory enforcement and class action litigation.

DLA Piper and NotPetya (2017)

On June 27, 2017, the global firm DLA Piper's phones and computers went down in the NotPetya outbreak, a destructive malware attack that spread worldwide that day. According to Law.com International's reporting from June 27 to 30, 2017, the firm worked with the FBI, the UK National Crime Agency and Microsoft to restore systems over the following days, and later reporting said the firm had an incident response plan.⁴⁷ Cost figures for the firm were not confirmed for this module. The lesson for small firms: an attack aimed at someone else can still take a firm offline, which is the "significantly impaired" half of Opinion 483's definition, and client communication during an outage depends on having contact lists and channels that do not depend on the firm's network.

Grubman Shire Meiselas and Sacks (2020)

In May 2020 the New York entertainment law firm was hit by the REvil (also called Sodinokibi) ransomware group. According to Rolling Stone, the attackers claimed to have taken 756 gigabytes of data and raised their demand from $21 million to $42 million. The firm said it would not pay and was working with the FBI.⁴⁶ Whether any ransom was eventually paid was not confirmed. The case shows the "double extortion" pattern, where stolen data rather than locked files is the main threat, which is exactly the situation in which Opinion 483 requires client notice regardless of whether the firm pays.

New York attorney general and Heidell, Pittoni, Murphy and Bach (2023)

This is the clearest regulatory enforcement action against a law firm for security and notice failures. According to the New York attorney general's announcement of March 27, 2023, the firm, which represents New York area hospitals, paid $200,000 in penalties. In November 2021 an attacker exploited a Microsoft Exchange vulnerability for which patches "had been released by Microsoft several months earlier," and deployed malware in December 2021; the firm later found that "tens of thousands of files had been potentially taken." About 114,979 people were affected, including 61,438 New Yorkers, and the data included names, dates of birth, Social Security numbers and health data. Notices did not begin until May 2022. The attorney general found failures in risk assessment, encryption of stored data and data minimization, and cited HIPAA, since the firm held hospital patients' records.²⁶

The settlement required a full written information security program, encryption, centralized logging and monitoring (logs accessible for at least 90 days and kept for at least one year), patch management, penetration testing, and data minimization and deletion.²⁶ For a small firm, the list is a reasonable picture of what a regulator expects after the fact. The patch had been available for months; the notice came about six months after the attack began.

Orrick, Herrington and Sutcliffe (2023) and the $8 million settlement

Orrick suffered a breach in 2023. According to the ABA Journal, Orrick first reported about 153,000 affected people, but more than 638,000 people eventually received notices; plaintiffs said names, addresses, birth dates and Social Security numbers were exposed. Judge Susan Illston of the U.S. District Court for the Northern District of California gave final approval to an $8 million class settlement, reported November 12, 2024.⁴⁸ The case caption and docket number were not confirmed for this module. The lesson: the people suing a firm after a breach are often not its clients but the clients' customers, employees or patients whose data the firm held, and the count of affected people tends to grow as the investigation goes on, so first notices should not overstate certainty.

What the cases teach

Common mistakes

• Leaving a known patch uninstalled. The Heidell, Pittoni attack used a Microsoft Exchange flaw for which patches had been out for months. A firm that runs its own email server, or any internet-facing system, needs someone responsible for installing security updates quickly.²⁶
• Waiting months to tell people. In the same case, notices began about six months after the intrusion started. Idaho's statute and Opinion 483 set no fixed number of days, but "without unreasonable delay" is judged after the fact by a regulator or a court.²⁶⁶
• Keeping everything forever. Old closed files multiply the number of people affected. The New York settlement required data minimization and deletion; Opinion 483 urges the same.²⁶¹
• Understating the count in the first notice. Orrick's first reported figure of about 153,000 grew to more than 638,000 notices. Early notices should say what is known and that the investigation continues.⁴⁸
• Treating payment as the end of the matter. Paying a ransom does not undo the theft of data, and under Opinion 483 and the FTC rule, acquisition of data is what triggers notice.¹³⁵
• Overstating controls on an application or questionnaire. The Travelers v. ICS lawsuit alleged that MFA was claimed on systems where it was not used, and the policy was rescinded by agreed judgment.³⁰³¹
• Using the compromised email account to manage the incident. If the attacker is reading the firm's mailbox, emailing clients about the breach, or emailing the insurer about strategy, tells the attacker everything.
• Not warning clients about wire fraud until after the loss. In McCabe v. Talero the firm's emails telling buyers to verify instructions by phone became part of its defense; a firm without such a warning has a weaker position.²¹
• Forgetting the IRS clock. A tax office that spends the first week on recovery and calls the IRS later has missed the next-business-day standard in Publication 1345, and lost the IRS's chance to stop fraudulent returns.⁴
• Assuming small means exempt. The Safeguards Rule's small-entity exception does not cover the FTC notice in 314.4(j), and the Idaho statute applies to a firm of any size with even one affected Idaho resident.³⁸¹⁰
• Relying on a boilerplate AI clause. Opinion 512 says general engagement letter language authorizing AI use is not enough where informed consent is needed.²⁴

Questions people ask

If our firm is breached, did we violate the ethics rules?

Not automatically. Idaho Rule 1.6 Comment [19] says unauthorized access or disclosure "does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure." The question is whether the firm's efforts were reasonable given the sensitivity of the information, the likelihood of disclosure without more safeguards, the cost and difficulty of more safeguards, and their effect on the firm's ability to serve clients.² A separate violation can arise from the response, for example failing to tell clients under Rule 1.4.

Ransomware locked our files for two hours and the forensic firm found no data left the network. Do we have to tell clients?

Under Opinion 483, notice is not required if no client information was "inaccessible for any material amount of time" and it was not accessed or disclosed.¹ Whether two hours is material depends on what was happening: a two-hour outage on a quiet afternoon is different from one during a filing deadline. Document the forensic findings and the reasoning. If a client's matter was affected by the outage, Rule 1.4's general duty to keep the client informed may still call for a conversation.

Our firm held a client's employee records and they were stolen. Who notifies the employees?

Under Idaho Code 28-51-105(2), a firm that maintains data it does not own must "give notice to and cooperate with the owner or licensee" immediately after discovery if misuse occurred or is reasonably likely. The owner, usually the client, then has the duty to notify the affected Idaho residents, though the two often agree that the firm will send the notices and pay for them.⁶ The client relationship, any contract terms and, for health records, any business associate agreement shape who does what. Other states' laws for non-Idaho employees follow similar patterns but check each one.

Is there an Opinion 483 for CPAs?

No equivalent AICPA interpretation on breach notice was found for this module. CPA firms rely on the confidentiality rule (ET 1.700.001), Idaho's accountancy rule on confidential client information (IDAPA 24.30.01.201), state breach statutes, and, for firms that prepare tax returns, the FTC Safeguards Rule and IRS requirements, which set the hard deadlines.¹⁴¹¹³⁴

Can an engagement letter make the client responsible for wire fraud losses?

An engagement letter can set expectations, warn clients, and describe the client's own security steps, and courts look at who was in the best position to prevent a loss.²⁷ But a letter cannot remove the firm's own duties under Rule 1.6(c) or Rule 1.15, and lawyers face separate ethics limits on agreements that limit malpractice liability. The safest use of the letter is as a warning that prevents the loss, not as a shield after it.

Who pays for notice letters and credit monitoring?

Usually the firm or its cyber insurer, if the policy covers notification costs. Idaho's statute does not require a firm to offer credit monitoring; some other states do in some situations, and offering it is common practice. Where the firm held the data for a client, the engagement terms or a data processing agreement may assign costs; many corporate outside counsel guidelines require the firm to pay.

Will the FTC make our notice public?

Expect so. The notice must state whether law enforcement has determined in writing that public notice would impede a criminal investigation or damage national security, a question that only matters if notices are published.³ Summaries of the final rule by firms that follow the FTC report that notices submitted on the FTC's form "will be published on a publicly-available database."⁴⁹³⁶ A firm should write its FTC notice as if clients and reporters will read it.

Hard questions

Should lawyers have to report their own breaches to the bar?

For a reporting rule: Clients often learn of a breach only from the firm. A reporting rule would let the bar see patterns (which practice areas, which vendors, which entry points), warn other firms quickly, and check that clients were told. Regulators already get notice in many sectors: health care entities report to HHS, financial institutions to the FTC or SEC.

Against: The bar is a licensing body, not a security agency, and has no investigators trained in forensics. A reporting rule could deter candor during the most stressful week of a firm's life, could be read as an admission, and adds a clock to a list of clocks. Breach statutes, insurers and client contracts already push firms to act.

What the evidence shows: Idaho has no such rule as of October 28, 2026, and no Idaho State Bar opinion on data breaches.³² The ABA's 2023 survey shows that only about a third of firms have a plan and that 19 percent of lawyers did not know whether their firm had ever been breached, which suggests that neither the bar nor most firms currently have good data on how often breaches happen.⁸

Should ransom payments by professional firms be banned?

For a ban: Payments fund criminal groups and encourage more attacks; a ban would remove the incentive to target firms that are likely to pay. The U.S. government already "strongly discourages" payment.⁹

Against a ban: A firm with no usable backups and court deadlines may face harm to clients that payment would reduce; a ban could push payments underground and discourage reporting, which OFAC counts as a mitigating factor precisely to encourage it. A small firm cannot rebuild in a weekend the way a large one can.

What the evidence shows: Federal policy is to discourage payment and enforce sanctions on a strict liability basis, not to ban all payments. OFAC's mitigating factors (prompt reporting, cooperation, backups, plans) reward preparation, and preparation is the factor a firm controls.⁹

Are corporate clients' security demands fair to small firms?

The clients' case: Their data, their regulators and their employees are at stake. The BCLP and Mondelez settlement shows that a client can be sued over its law firm's breach, and Regulation S-P and the Safeguards Rule require regulated clients to oversee their service providers.¹²⁵³

The small firms' case: A 10-person firm can face dozens of questionnaires, each asking for the same facts in a different format, plus audit rights and short notice deadlines that a large firm can staff and a small one cannot. Requirements written for large firms can shut small and local firms out of corporate work.

What the evidence shows: Client demands are common: about a quarter of lawyers in the 2023 survey had been asked for security documents. The basic controls clients ask for (MFA, encryption, backups, training, a plan) are the same ones insurers and regulators look at, so meeting them once serves several audiences.⁸

Should Idaho set a fixed day count for breach notice?

For a fixed deadline: "Without unreasonable delay" lets firms take months, as the six-month gap in the Heidell, Pittoni case shows; a fixed number gives people a firm expectation and regulators a clear test.²⁶

Against: Investigations vary. A fixed short deadline can force notices before a firm knows who was affected, producing confusing or inaccurate letters, and the federal rules already set 30-day clocks for many financial firms.

What the evidence shows: Idaho has no fixed day count for private entities as of October 28, 2026.⁶ The 2025 effort to rewrite the Idaho breach law is covered in Idaho Privacy Law Up Close.

Where to go next

• IRS Publication 5708, Creating a Written Information Security Plan: Free IRS template for tax and accounting firms, with a sample attachment on security breach procedures and notifications. Fill in the blanks and keep it with your incident response plan.
• IRS, Data Theft Information for Tax Professionals: Free. The IRS's own list of who to contact after data theft, including the IRS liaison and the state route through the Federation of Tax Administrators. Print it and add your local contacts.
• FTC Safeguards Rule page: Free. The current rule, its history and the link to the online form for 500-plus consumer notification events. Check it before filing.
• FBI Internet Crime Complaint Center (IC3): Free. File complaints about ransomware, email compromise and fraudulent transfers; quick reports give the Recovery Asset Team a chance to freeze funds.
• OFAC ransomware advisory (September 21, 2021): Free, about 8 pages. Read it before an incident so the firm's leaders know the sanctions facts and the mitigating factors (prompt reporting, cooperation, backups, plans).
• ABA Formal Opinion 483: Free PDF from the ABA. The main written guidance on lawyers' duties after a breach; worth reading in full by the firm's ethics partner.
• Idaho Code Title 28, Chapter 51: Free. Idaho's breach notice statute in its current form, sections 28-51-104 to 28-51-107.

Still being checked (8 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• Grubman Shire: whether any ransom was eventually paid is not confirmed.
• DLA Piper NotPetya cost figures are not confirmed.
• Orrick class action caption and docket number were not confirmed; facts are from the ABA Journal.
• Travelers v. ICS facts and outcome come from Reed Smith and Lockton summaries, not the court docket.
• The statement that FTC Safeguards notifications will be published in a public database comes from a law firm summary of the final rule, not a direct reading of the Federal Register text.
• Typical cyber insurance application questions and outside counsel guideline terms are described as common industry practice; no single standard form was verified.
• No separate Idaho State Tax Commission breach-reporting procedure for preparers was confirmed beyond the Federation of Tax Administrators route.
• Idaho's adoption date for Rule 1.1 Comment [8] comes from the LawSites tracker; the Idaho Supreme Court order was not located.

Last verified October 28, 2026. General education, not legal, ethics, accounting or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. American Bar Association Standing Committee on Ethics and Professional Responsibility, Formal Opinion 483, Lawyers' Obligations After an Electronic Data Breach or Cyberattack (Oct. 17, 2018), including the definition of a data breach, the monitoring, response, investigation and notice duties, the ransomware discussion, former clients under Rule 1.9(c), and footnote 45 on data minimization (read Oct. 28, 2026, in a full copy of the opinion; americanbar.org blocked automated download). Read it online. ↩
2. Idaho State Bar, Idaho Rules of Professional Conduct, Full Text, current as of March 9, 2026: Rules 1.0(e) and (n), 1.1 and Comment [8], 1.4(a) and (b), 1.6(a) and (c) with Comments [19] and [20], 1.9(c), 1.15(a), and 5.3 Comment [3]. Idaho Comment [19] corresponds to ABA Model Rule 1.6 Comment [18]. Idaho's adoption of Rule 1.1 Comment [8] is dated March 17, 2014, effective July 1, 2014, by the LawSites tracker (lawnext.com/tech-competence); the Idaho Supreme Court order itself was not located (read Oct. 28, 2026). Read it online. ↩
3. 16 CFR 314.4, Elements (FTC Standards for Safeguarding Customer Information), paragraphs (c)(3), (c)(6), (f), (h) and (j), current text via the Cornell Legal Information Institute mirror of the eCFR; the eCFR page for Part 314 reported being up to date as of Oct. 23, 2026 (read Oct. 28, 2026). Read it online. ↩
4. Internal Revenue Service, Publication 1345, Handbook for Authorized IRS e-file Providers of Individual Income Tax Returns (Rev. 12-2025), Catalog Number 64382J, security, privacy and business standards for online providers, including the next-business-day incident report. The publication says electronic return originators "must contact their local stakeholder liaison" (read Oct. 28, 2026). Read it online. ↩
5. U.S. Securities and Exchange Commission, Regulation S-P: Small Entity Compliance Guide for the amendments adopted May 16, 2024 (Release 34-100155), covering covered institutions, the incident response program, 30-day customer notice, 72-hour service provider notice and the compliance dates of Dec. 3, 2025 and June 3, 2026 (read Oct. 28, 2026). Read it online. ↩
6. Idaho Code 28-51-105, Disclosure of breach of security of computerized personal information, subsections (1) to (3), including the 24-hour attorney general notice for agencies only, Idaho Legislature website (read Oct. 28, 2026). Read it online. ↩
7. Idaho Code 28-51-107, Violations, Idaho Legislature website (read Oct. 28, 2026). Read it online. ↩
8. John Simek, 2023 Cybersecurity TechReport, ABA Law Practice Division (Dec. 18, 2023), based on the 2023 ABA Legal Technology Survey Report; no 2024 or 2025 cybersecurity edition was found (read Oct. 28, 2026). Read it online. ↩
9. U.S. Department of the Treasury, Office of Foreign Assets Control, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sept. 21, 2021), which updates and supersedes the advisory of Oct. 1, 2020. Web searches of treasury.gov and news coverage on Oct. 28, 2026 found no later OFAC ransomware advisory (read Oct. 28, 2026). Read it online. ↩
10. Idaho Code 28-51-104, Definitions (added 2006, ch. 258; amended 2015, ch. 141), subsections (2) breach of the security of the system, (4) notice, (5) personal information and (6) primary regulator, Idaho Legislature website (read Oct. 28, 2026). Read it online. ↩
11. IDAPA 24.30.01, Idaho Accountancy Rules, Division of Occupational and Professional Licenses, rules 002 (incorporation of AICPA standards), 201 (confidential client information) and 202 (records) (read Oct. 28, 2026). Read it online. ↩
12. ABA Journal, "BigLaw firm and client agree to settlement in data breach suit by client's employees" (Oct. 11, 2024), on the Bryan Cave Leighton Paisner and Mondelez Global $750,000 settlement (press report) (read Oct. 28, 2026). Read it online. ↩
13. U.S. Attorney's Office, Southern District of New York, "Manhattan U.S. Attorney Announces Arrest Of Macau Resident And Unsealing Of Charges Against Three Individuals For Insider Trading Based On Information Hacked From Prominent U.S. Law Firms" (Dec. 27, 2016) (read Oct. 28, 2026). Read it online. ↩
14. AICPA, Code of Professional Conduct (effective Dec. 15, 2014, updated through December 2023), ET 1.150.040, 1.700.001 and 1.700.040, as hosted by the Minnesota Society of CPAs; and AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022), the basis of SOC 2 reports (read Oct. 28, 2026). Read it online. ↩
15. ABA Formal Opinion 99-413, Protecting the Confidentiality of Unencrypted E-Mail (March 10, 1999) (read Oct. 28, 2026). Read it online. ↩
16. ABA Formal Opinion 477R, Securing Communication of Protected Client Information (May 11, 2017, revised May 22, 2017) (read Oct. 28, 2026). Read it online. ↩
17. Idaho State Bar, Scam Alert posts, including April 22, 2024 (Dropbox links used to set up wire transfers of settlement funds) (read Oct. 28, 2026). Read it online. ↩
18. ABA Formal Opinion 11-459, Duty to Protect the Confidentiality of E-mail Communications with One's Client (Aug. 4, 2011). The ABA copy is members-only; the headnote was read in a copy hosted by Hinshaw & Culbertson (read Oct. 28, 2026). Read it online. ↩
19. FBI Internet Crime Complaint Center, 2025 Internet Crime Report (released April 2026): business email compromise complaints and losses, transaction types, Recovery Asset Team and Financial Fraud Kill Chain results, and Idaho state figures (read Oct. 28, 2026). Read it online. ↩
20. FBI Internet Crime Complaint Center, Public Service Announcement I-091124-PSA, Business Email Compromise: The $55 Billion Scam (Sept. 11, 2024) (read Oct. 28, 2026). Read it online. ↩
21. McCabe v. Talero, 2025 NY Slip Op 50597(U) (Sup. Ct. Queens County, March 31, 2025) (read Oct. 28, 2026). Read it online. ↩
22. North Carolina State Bar, 2015 Formal Ethics Opinion 6, Lawyer's Professional Responsibility When Third Party Steals Funds from Trust Account (adopted Oct. 23, 2015), Inquiry #5. Not Idaho law (read Oct. 28, 2026). Read it online. ↩
23. ABA Formal Opinion 08-451, Lawyer's Obligations When Outsourcing Legal and Nonlegal Support Services (Aug. 5, 2008) (read Oct. 28, 2026). Read it online. ↩
24. ABA Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024), on informed consent, boilerplate engagement letter provisions, terms of use and fees (read Oct. 28, 2026). Read it online. ↩
25. 26 CFR 301.7216-3, Disclosure or use permitted only with the taxpayer's consent, via the Cornell LII mirror (read Oct. 28, 2026). Read it online. ↩
26. Office of the New York State Attorney General, "Attorney General James Secures $200,000 from Law Firm for Failing to Protect New Yorkers' Personal Data" (March 27, 2023), on Heidell, Pittoni, Murphy & Bach LLP. The settlement required a "comprehensive information security program" among other measures (read Oct. 28, 2026). Read it online. ↩
27. Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., No. 17-4177 (6th Cir. Nov. 27, 2018) (not recommended for full-text publication) (read Oct. 28, 2026). Read it online. ↩
28. MSSP Alert, "Cl0p Hackers Hit Three of the Biggest U.S. Law Firms in Large Ransomware Attack" (2023, article undated), on the MOVEit Transfer exploitation of May and June 2023 (press report) (read Oct. 28, 2026). Read it online. ↩
29. ABA Formal Opinion 498, Virtual Practice (March 10, 2021) (read Oct. 28, 2026). Read it online. ↩
30. Reed Smith, "Insurance applications under scrutiny: lessons from Travelers v. ICS" (July 2022), describing Travelers Property Casualty Co. of America v. International Control Services, Inc., filed July 6, 2022 in the U.S. District Court for the Central District of Illinois (secondary source) (read Oct. 28, 2026). Read it online. ↩
31. Lockton, "Travelers v. ICS underscores need to respond carefully to cyber insurance applications" (Sept. 15, 2022), reporting the agreed judgment rescinding the policy entered Aug. 26, 2022 (secondary source) (read Oct. 28, 2026). Read it online. ↩
32. Idaho State Bar, Formal Ethics Opinions page (opinions No. 1, 1944, to No. 136, 1999; the ethics committee was suspended in 1994), and notice of Formal Ethics Opinion 137 (Sept. 18, 2024), on the transition to the State Public Defender system (read Oct. 28, 2026). Read it online. ↩
33. ABA Formal Opinion 482, Ethical Obligations Related to Disasters (Sept. 19, 2018) (read Oct. 28, 2026). Read it online. ↩
34. Idaho Bar Commission Rules, Section XIII, Trust Accounts, Rules 1307 (overdraft notice) and 1308, current as of March 9, 2026 (read Oct. 28, 2026). Read it online. ↩
35. 16 CFR 314.2, Definitions, including 314.2(h)(2)(viii) (an accountant or tax preparation service is a financial institution) and 314.2(m) (notification event), current text via the Cornell LII mirror (read Oct. 28, 2026). Read it online. ↩
36. Federal Trade Commission, Standards for Safeguarding Customer Information, final rule, 88 FR 77499 (Nov. 13, 2023), effective May 13, 2024 (read Oct. 28, 2026). Read it online. ↩
37. Federal Trade Commission, Safeguards Rule page, with links to the online notification form and the rule history (read Oct. 28, 2026). Read it online. ↩
38. 16 CFR 314.6, Exceptions (financial institutions with customer information on fewer than 5,000 consumers), via the Cornell LII mirror (read Oct. 28, 2026). Read it online. ↩
39. Internal Revenue Service, "Data Theft Information for Tax Professionals" (page last reviewed March 26, 2026). The page directs preparers to contact their IRS Stakeholder Liaison (read Oct. 28, 2026). Read it online. ↩
40. Internal Revenue Service, Publication 4557, Safeguarding Taxpayer Data: A Guide for Your Business (Rev. 6-2024) (read Oct. 28, 2026). Read it online. ↩
41. Internal Revenue Service, Publication 5708, Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024), sample attachment C, Security Breach Procedures and Notifications (read Oct. 28, 2026). Read it online. ↩
42. U.S. Securities and Exchange Commission, press release 2024-58, "SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information" (May 16, 2024); final rule published at 89 FR 47688 (June 3, 2024) (read Oct. 28, 2026). Read it online. ↩
43. Idaho Code 28-51-106, Procedures deemed in compliance with security breach requirements, Idaho Legislature website (read Oct. 28, 2026). Read it online. ↩
44. Federal Bureau of Investigation, Salt Lake City Field Office, "About" page, listing resident agencies in Boise, Coeur d'Alene, Lewiston and Pocatello (read Oct. 28, 2026). Read it online. ↩
45. ABA Formal Opinion 515, A Lawyer's Discretion to Report When a Client Commits a Crime Against the Lawyer or Against Someone Associated with, or Related to, the Lawyer (March 5, 2025) (read Oct. 28, 2026). Read it online. ↩
46. Rolling Stone, reporting on the REvil ransomware attack on Grubman Shire Meiselas & Sacks (May 2020) (press report) (read Oct. 28, 2026). Read it online. ↩
47. Law.com International, "DLA Piper Hit By Cyber Attack, With Phones and Computers Down Across the Firm" (June 27, 2017), and follow-up coverage through June 30, 2017 (press report) (read Oct. 28, 2026). Read it online. ↩
48. ABA Journal, "Judge gives final OK to $8M settlement in Orrick data breach" (Nov. 12, 2024) (press report; case caption and docket number not confirmed) (read Oct. 28, 2026). Read it online. ↩
49. Covington & Burling, "FTC Finalizes New Notification Requirement for GLBA Safeguards Rule" (November 2023) (secondary summary of the final rule) (read Oct. 28, 2026). Read it online. ↩
50. Idaho Legislature, 2025 House Bill 117, Insurance Data Security Act (returned to the Business Committee March 20, 2025), and NAIC, Insurance Data Security Model Law #668 state page (Summer 2026) (read Oct. 28, 2026). Read it online. ↩