Law Firm Cybersecurity in Charlotte: Protecting Client Data

Protecting client data comes down to four working parts: controlling who can open which matter, securing email and the money that moves through it, vetting every vendor that touches a file, and keeping a written plan for the day something breaks. North Carolina’s Rules of Professional Conduct ask lawyers for reasonable efforts, not perfect ones. What has changed is that “reasonable” now assumes a firm understands the technology its practice runs on.

That assumption is where firms get caught. In the American Bar Association’s technology survey, roughly 29% of responding firms said they had experienced a security breach at some point, and firms in the 10 to 49 attorney range reported some of the highest rates. Those are firms holding serious client information with fairly modest defenses. Below is what we see matter most for firms across Charlotte, North Carolina, including the parts that usually get missed.

Why Do Cybercriminals Target Law Firms More Than Most Businesses?

Law firms hold concentrated value. One firm may store deal terms for a dozen companies, litigation strategy, financial statements, medical records, and personal details for thousands of people. An attacker who cannot break into a manufacturer’s network can often get the same information from the firm advising it. Lawyers are, in effect, a shortcut.

Money is the second draw. Trust accounts, real estate closings, and settlement disbursements mean large sums move on short notice, often on the strength of an email. Very few businesses wire six figures on a Tuesday afternoon because a message asked them to. Law firms do it as routine work.

Charlotte makes this local rather than abstract. The region’s banking, insurance, healthcare, and construction activity means firms here handle exactly the matter types attackers look for, and the volume of residential and commercial closings across Ballantyne, Matthews, and Monroe puts a steady stream of wire instructions into local inboxes. A firm does not need to be large to be worth an attacker’s time. It needs to be holding something valuable and running without anyone watching the systems.

What Does “Reasonable Efforts” Actually Mean Under the Rules?

Rule 1.6(c) asks a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or access to, information relating to a client. Comment 8 to Rule 1.1 ties competence to technology, saying a lawyer should keep current on the benefits and risks of the technology relevant to the practice. North Carolina adopted that comment in 2014.

Notice what the rules do not say. They do not name a product, a firewall, or a password length. The North Carolina State Bar addressed hosted software in 2011 Formal Ethics Opinion 6 and reached the same conclusion: a firm may use it, provided the firm uses reasonable care to safeguard confidential client information. The opinion also said something that gets quoted far less often. A lawyer should keep learning about the technology chosen, consult periodically with professionals competent in online security, and be willing to abandon a service if something comes to light that calls its security into question.

That last part reframes the whole obligation. Reasonable security is not a box a firm checks during onboarding and forgets. It is a process: assess what you hold, put controls around it, confirm the controls are working, and revisit the decision as things change. A firm that ran a careful review in 2021 and has not looked since is not holding a 2021 answer anymore. It is holding no answer. Our compliance services exist for exactly this reason, because the documentation of that ongoing process is what a firm needs when a client, an insurer, or a regulator asks what it has been doing.

How Does Email Put Client Money at Risk?

Business email compromise is the most expensive threat facing law firms right now, and it does not require breaking any encryption. An attacker gets into one mailbox somewhere in a transaction, then reads quietly for weeks. At the moment funds are due, a message arrives with updated wire instructions from an address off by a single character. It references the right property, the right closing date, the right names.

North Carolina firms have already learned this the hard way. In one reported case, a firm received an email and a phone call from a woman claiming to be the out of state seller in a closing it was handling, and wired funds on a Friday. By Monday the firm learned the real seller’s email had been compromised and the money had gone to the attacker. The wire could not be reversed. In a separate North Carolina case, the fraudulent address differed from the seller’s by one letter.

The defenses are unglamorous and they work:

• Verify every set of wire instructions by voice, using a phone number you already had on file, never one printed in the email itself.
• Treat any mid transaction change to wire details as fraudulent until proven otherwise. Legitimate parties rarely change banking details days before closing.
• Require multifactor authentication on every mailbox in the firm, partners included.
• Watch for new mail forwarding rules. Attackers who take over a mailbox almost always create a hidden rule that routes replies away from the real user, so the owner never sees the conversation happening in their name. Very few firms monitor for this, and it is one of the clearest early signals available.
• Tell clients in the engagement letter, in writing, that your firm will never send changed wire instructions by email.

Watching for that activity across every account is not something a busy office administrator can do between other tasks, which is where our managed security services come in.

Should Everyone at the Firm Be Able to See Every Matter?

No, and this is the most common gap we find. Most firms in the 50 to 200 person range grew into a shared document library where anyone who can sign in can open almost anything. It happened for practical reasons. Nobody wanted to file a ticket to get at a file at 7pm, and setting up permissions properly took an afternoon nobody had.

The security argument for fixing it is simple arithmetic. When one person’s password is stolen, the damage equals whatever that person could reach. If a paralegal in family law can open the corporate acquisition folders, then a phishing email sent to that paralegal exposes the acquisition. Limiting access by matter and by role does not stop the phishing. It caps the loss.

The ethics argument is the one that tends to move managing partners. Sooner or later the firm hires a lateral who worked the other side of an active matter, or takes on a client whose interests brush against an existing file. At that point the firm needs a screen, and a screen has to be real, not a promise in a memo. You cannot screen someone from documents that every single account in the building can open. Firms discover this on about a week’s notice, usually during a conflicts review, and then try to build the capability under pressure. Building it while nothing is on fire is far cheaper. The same structure pays off when a lawyer leaves, because a firm that knows who could reach what also knows what walked out the door.

How Should You Vet the Vendors Holding Your Files?

Client data almost never stays inside the firm. It sits with practice management providers, document platforms, electronic discovery vendors, transcription services, court reporters, translators, and co counsel. Each one is a way in, and the firm remains responsible for the information under Rule 5.3.

North Carolina’s 2011 opinion gives a practical starting checklist, and the State Bar’s 2024 Formal Ethics Opinion 1 applied the same reasoning to artificial intelligence tools. Before client material goes anywhere:

• Ask where the data is physically stored and which people at the vendor can access it.
• Get breach notification written into the contract, with a stated time limit rather than a vague promise.
• Confirm you can export your files in a usable format if the relationship or the company ends. A vendor holding your only copy is holding your practice.
• Ask which subcontractors the vendor uses, since their security is now yours as well.
• Decide in writing which AI tools may touch client material and which may not, and make sure the ones you allow do not train on what you feed them.

Firms often run this review carefully for their document system and skip it entirely for the small tools that accumulate around the edges: the transcription app one lawyer likes, the file sharing link a client suggested, the AI summarizer somebody added last quarter. Those are the ones we ask about first. Our cloud cybersecurity services are built around keeping that sprawl visible and controlled.

Is Keeping Every File Forever a Real Risk?

Yes, and it is the risk firms are least comfortable discussing. Law firms rarely delete anything. A matter closes, the folder stays, and fifteen years later that closed file is still sitting on a live share where a compromised account can read it. Every one of those records is still stealable, and every one of them can pull the firm into notification duties if it leaves the building.

The useful reframe is treating retention as a security control rather than a records management chore. Data you no longer hold cannot be stolen, and it cannot appear in a breach notice. That does not mean deleting freely, because holds, statutes of limitation, and property obligations under Rule 1.15 all constrain what a firm may discard and when. What it means is having a written schedule, returning client files at closeout as a matter of course, and moving archives into encrypted storage away from the systems people use daily.

Ransomware has changed the math here too. Attackers now copy data out before they encrypt anything, so they have leverage even against a firm with good backups. Restoring quickly still matters enormously, and firms without tested data backup and recovery are in a much worse position. But recovery alone does not answer the disclosure problem. Keeping less on hand does.

Who Do You Have to Tell After a Breach, and How Quickly?

Two separate sets of obligations apply, and firms tend to know one and miss the other. North Carolina’s Identity Theft Protection Act sets the statutory track. Professional conduct rules set the ethical track, and it reaches further.

• Notify affected North Carolina residents without unreasonable delay after discovering the breach.
• Notify the Consumer Protection Division of the North Carolina Attorney General’s Office of every qualifying breach, including the nature of the incident, how many people were affected, what you did to investigate, and what you changed afterward.
• If more than 1,000 people are notified at once, also notify the nationwide consumer reporting agencies.
• Understand the exposure. Violations are treated as unfair and deceptive trade practices, which opens the door to treble damages.
• Separately, ABA Formal Opinion 483 requires notifying current clients when a breach involves, or likely involves, material client information. This duty is broader than the statute, because it is not limited to personal identifiers. Litigation strategy is not personal information, but losing it is absolutely something a client needs to hear about.
• Note the encryption safe harbor. Properly encrypted data generally does not trigger statutory notice, so long as the key was not taken as well. That single provision is the strongest practical case for encrypting files at rest.

Survey work suggests only about a third of firms have an incident response plan, and a majority say they are unclear on their obligations after a breach. The first 48 hours are when a firm either follows a plan or improvises while trying to reach a lawyer, an insurer, and a client at the same time. For firms in Charlotte with clients in South Carolina as well, the picture gets more complicated, because each state sets its own notice rules and the shorter clock governs.

What Do Corporate Clients Ask Before They Hire Your Firm?

Security has quietly become a business development issue rather than only a risk issue. Banks, insurers, hospital systems, and larger corporate clients now send outside counsel guidelines with security terms attached, along with questionnaires the firm has to complete before engagement. The common requirements:

• Multifactor authentication across the firm, with no exceptions for leadership.
• Encryption of client data in transit and at rest.
• A defined breach notification window to the client, frequently 24 to 72 hours.
• Documented annual security training for lawyers and staff, with completion records.
• Cyber liability coverage at a stated minimum limit.
• A right to audit, or an accepted third party attestation in place of one.

Here is the part that surprises managing partners. A firm that can return a completed questionnaire with evidence inside a day looks like a firm that has its house in order, and it wins work on that basis. A firm that needs three weeks and cannot answer half the questions signals something else entirely, and the panel decision gets made without it. Insurers have moved the same direction, and many now require specific controls as a condition of coverage. A firm holding a policy without the controls behind it may find that out at the worst possible moment.

Where Should a Charlotte Firm Start?

Start with policy, not products. Once a firm decides in writing what it protects and who may see it, the technology decisions mostly answer themselves, and the budget goes toward things the firm actually needs.

• Write down what client information you hold, where it lives, and who may access each category.
• Turn on multifactor authentication everywhere, this quarter.
• Put your wire verification procedure in writing and train every person who touches money on it.
• Inventory every vendor and AI tool with access to client material.
• Set a retention schedule and start closing out old matters against it.
• Build an incident response plan and run it as a tabletop exercise once, before you need it.
• Review the whole thing annually, and document that you did.

Most firms we work with are not starting from zero. They have pieces in place and no clear picture of what is missing, which is the problem our IT guidance services address first.

Frequently Asked Questions

Do North Carolina lawyers have to encrypt email?

There is no blanket requirement to encrypt every message. ABA Formal Opinion 477R takes a fact specific approach: the more sensitive the information and the higher the risk, the stronger the protection required. For routine scheduling, ordinary email is generally fine. For a merger, a sealed filing, or personal health information, encryption or a secure portal is the reasonable choice.

Does cyber liability insurance cover a wire fraud loss?

Sometimes, and often for less than firms expect. Wire fraud losses frequently fall under social engineering or crime coverage rather than the main cybersecurity section of a policy, and those sublimits can be small. Many policies also require specific controls, such as multifactor authentication and callback verification, before they will pay. Read the conditions before assuming you are covered.

Can a small firm use hosted practice management software and still meet its obligations?

Yes. North Carolina’s 2011 Formal Ethics Opinion 6 confirmed that firms may use hosted software with reasonable care. The firm needs to understand the provider’s security, confirm it can retrieve its data if the service ends, and get a commitment that the provider will report breaches. Hosted platforms are frequently more secure than a server in a closet, provided the firm configures access properly.

How often should a law firm test its security?

Plan on an annual review of policies, access rights, and vendors, with phishing simulations run quarterly so training stays current. Test your backups by actually restoring from them at least twice a year. Any significant change, such as a new practice area, an office move, or a merger, should trigger its own review rather than waiting for the annual cycle.

Protecting Client Data Is a Practice Management Decision

Client confidentiality has always been the foundation of legal work. What has changed is that keeping the promise now depends on decisions about access, email, vendors, and retention that no one covers in law school. The firms handling this well are not the ones spending the most. They are the ones that wrote down what they protect, put controls behind it, and check their work on a schedule.

At CMIT Solutions of Metrolina, we support professional services firms throughout Charlotte, North Carolina, that hold sensitive client information and cannot afford to be offline or exposed. We handle the parts that keep a practice safe without keeping partners in meetings about it: constant monitoring, access controls built matter by matter, vendor review, encrypted backups that get tested, and an incident response plan written before anyone needs it. If your firm has not had these conversations, or has had them and never finished the work, request a consultation and we will show you where you stand.

Three things worth taking away:

• Reasonable security under the rules is an ongoing process, not a purchase. Assess, control, verify, and revisit.
• Email and wire verification deserve your attention first, because business email compromise is where firms lose money fastest and recover it least often.
• Access limits and retention schedules cap the damage of any single breach, and they cost far less than the notification and reputation work that follows one.