Law Firm Data Breach: Trade Secret Protection for Small Business

If you hand your source code, a proprietary formula, or a confidential business plan to outside counsel, your secret is now only as protected as their weakest laptop. That is the uncomfortable core of law firm data breach trade secret protection for a small business: the law does not automatically un-ring the bell once your material leaks. Before you email a single sensitive file, you should know what your attorney’s security actually is, what attorney-client privilege can and cannot recover after a breach, and which five questions separate a firm that guards your data from one that hopes for the best.

Why hackers target your lawyer, not you

Your firm may have modest defenses. Your attorney holds the concentrated version of everything worth stealing, sorted by matter and often stored for years. That is the appeal. A single law office can hold the trade secrets and litigation strategy of dozens of clients at once.

The threat is not theoretical. In May 2025 the FBI warned that a group called Silent Ransom, also tracked as Luna Moth was running a targeted campaign against U.S. law firms. Their method is low-tech and effective. Someone calls an attorney or staffer, claims to be the firm’s IT help desk, and talks them into opening a remote-access session. Google’s threat-intelligence team documented roughly 37 look-alike help-desk domains the group registered to make the ruse convincing. By 2025 the crew had dropped encryption entirely and moved to pure data theft, then extortion. Your confidential materials become the leverage.

What a law firm data breach means for your trade secrets

A trade secret is legally protected only while it stays secret and while you take reasonable steps to keep it that way. A breach threatens both prongs at once. The money follows. IBM’s 2025 Cost of a Data Breach Report put the U.S. average at $10.22 million, a record, even as the global figure fell to $4.44 million.

Law firms are not, on the whole, well defended. The American Bar Association’s 2025 TechReport found that about 29% of firms had experienced a security breach at some point, with smaller firms of 10 to 49 attorneys reporting some of the highest incident rates.

The privilege you think protects you has limits

Many owners assume attorney-client privilege is a force field. It is not, and this is where expectations and reality part company.

Privilege governs whether a communication can be compelled as evidence in a proceeding. It does not stop a thief, and it does not make stolen data disappear. Courts have generally held that theft alone does not waive privilege, so a document taken in a breach can remain privileged in a later case. That is cold comfort when the file is already posted on a leak site. Privilege might keep the material out of a courtroom. It cannot pull your formula back from a competitor who has already read it.

Two further limits matter for small businesses. Privilege protects legal advice, not the underlying secret itself, so the confidentiality of your formula rests on trade-secret law and your own precautions, not on privilege. And privilege can be pierced entirely under the crime-fraud exception when a client uses the lawyer to further a crime or fraud. The practical lesson is simple. Do not rely on privilege as your data-security plan. It is a rule of evidence, not a firewall.

Five questions to ask before you share sensitive materials

Vetting a firm’s security is not a technical audit. You are listening for specific, confident answers rather than reassurance. Ask these before the first confidential file leaves your hands:

• How is my data encrypted, at rest and in transit, and who at the firm can access it? You want role-based access and encryption as a default, not an upgrade.
• Do you require multi-factor authentication and phishing-resistant verification for staff? The Luna Moth attacks succeeded on people, so ask how the firm verifies an IT request before granting access.
• What is your incident-response plan, and how fast would I be notified? A firm that cannot describe its plan does not have one.
• Do you use outside vendors or contractors who touch my files, and how are they vetted? Your secret is only as safe as the least careful subcontractor.
• Will the engagement letter put your data-security obligations in writing? A firm that resists committing on paper is telling you where security ranks.

A firm that treats these as reasonable is showing you its practices. A firm that treats them as insulting is also showing you its practices. This is the same diligence we recommend when vetting how a firm uses AI tools, where the confidentiality of what you feed a system matters as much as the output.

What your engagement letter should say

The engagement letter is where security stops being a conversation and becomes an obligation. Most standard letters are silent on it. That silence favors the firm.

Ask for specific terms: a commitment to encrypt and restrict access to your files, a defined breach-notification window measured in days rather than “promptly,” a limit on which third-party vendors may handle your data, and a clear statement of what happens to your materials when the matter ends. Under ABA Model Rule 1.6, lawyers already owe you reasonable efforts to prevent unauthorized disclosure of client information. Putting the specifics in writing turns a general duty into an enforceable term. The letter is negotiable, as we cover in our guide to engagement-letter clauses that quietly shift risk onto clients. Read the data-security lines with the same care you would read a fee clause.

The takeaway for owners sharing IP

The value you are protecting sets the standard your counsel should meet. If a codebase or a formula is central to your business, a firm’s security is not a back-office detail. It is part of the representation. Ask the five questions and get the terms in writing. Treat any firm that stalls as having answered you already.