On March 4, 2016, the FBI's Cyber Division issued a Private Industry Notification (via Bloomberg BNA) alerting law firms that "[i]n a recent cyber criminal forum post, a criminal actor posted an advertisement to hire a technically proficient hacker for the purposes of gaining sustained access to the networks of multiple international law firms." The Cyber Division added that the criminals are seeking to gain access to law firm networks in order to obtain material, nonpublic information that can be used for insider trading.

The Cyber Division also advised law firms that they can help deter hackers through defensive measures such as scrutinizing links and not opening attachments in emails, disabling macros, and otherwise educating employees on "appropriate preventative and reactive actions to known criminal schemes...." 

As I discussed here in detail in April 2014, the SEC and DOJ have brought numerous recent insider trading cases involving information stolen from major law firms (the SEC and DOJ have filed more of these law firm-related cases since April 2014, as well). As the Bloomberg BNA article notes, however, the Cyber Division's recent warning focuses on outside hackers (rather than law firm employees) trying to break into law firm networks to steal market-moving information. 

Criminals' desire to hack the valuable information stored on law firm networks is alarming but entirely predictable. As I have previously observed, law firms' computer networks are a natural target as they are "a depository for extremely valuable information—like a Fort Knox for confidential corporate information rather than gold bullion, and without the impenetrable security systems." Law firms already on notice that their networks were under attack from employees must now must be just as alert to the threats posed by people outside the firm.

Topics