The California Consumer Privacy Act (CCPA) and Law Firm Liability

The CCPA applies to any business that meets its revenue or data-processing thresholds, and many mid-size California firms qualify. The California Privacy Protection Agency has continued to issue enforcement updates that clarify how businesses, including professional service firms, must handle consumer data requests, breach notifications, and opt-out mechanisms. A firm that collects intake data, stores medical records for personal injury matters, or maintains financial documents for estate planning clients may hold "personal information" as defined under the statute. Penalties run up to $7,500 per intentional violation, and a cyber liability policy form may respond to regulatory defense costs and fines where insurable by law, depending on how the insuring agreement is written.

Duty of Confidentiality vs. Digital Data Vulnerabilities

The State Bar's ethical obligations predate digital technology, but the ethics opinions on attorney competence now explicitly address cybersecurity. Rule 1.6 requires reasonable measures to prevent unauthorized disclosure of client information. A firm that stores privileged documents on an unencrypted cloud server or permits attorneys to access case files over unsecured Wi-Fi may already be in violation, even before a breach occurs. The proposed AI ethics rules place additional obligations on attorneys who use generative AI tools that may process or retain client data. Cyber insurance does not fix a compliance gap, but it can fund the breach response, regulatory defense, and client notification costs that follow one.

Trust Account Wire Fraud and Social Engineering Endorsements

Wire fraud targeting law firm trust accounts has become a refined operation. Attackers monitor email threads between attorneys and clients, then inject fraudulent wiring instructions at the moment of closing. Real estate, probate, and corporate transaction practices are frequent targets. The 2025 State of Wire Fraud report found that real estate transactions remain the primary vector for business email compromise schemes, and the pattern has only intensified into 2026. A standard cyber policy may exclude social engineering losses unless a specific endorsement is added. At Bloc Cyber, we review the social engineering sublimit, the verification procedure requirement, and whether the endorsement covers funds held in trust, not just the firm's own operating accounts.

Privileged Document Exposure and Digital Forensic Costs

When privileged documents are exposed through a ransomware attack or misconfigured file share, the firm faces a dual problem: the cost of forensic investigation and the potential waiver of attorney-client privilege. Digital forensics for a mid-size firm typically runs $30,000 to $150,000 depending on the number of endpoints and the complexity of the network. A cyber policy's first-party coverage should fund the forensic vendor, the breach coach (typically outside counsel retained by the carrier), and the notification costs required under California Civil Code Section 1798.82. The policy form's definition of "computer system" and "network" determines whether cloud-hosted document management platforms are included.

Third-Party Liability for Client Confidentiality Breaches

Clients whose data is exposed may bring claims for negligence, breach of fiduciary duty, or violation of the CCPA's private right of action. Third-party cyber liability coverage responds to these claims by funding defense costs and, if applicable, settlement or judgment. The retention (deductible) on third-party claims is often separate from the first-party retention, and some forms apply a single aggregate limit across both. You need to understand whether your policy stacks sublimits or shares them, because a firm hit with both a ransomware event and a resulting client lawsuit could exhaust a shared limit quickly.

Table: Malpractice Insurance vs. Standalone Cyber Coverage

The gap between these two policy types is where most uninsured losses occur. A firm carrying $2 million in malpractice coverage and no cyber policy has a significant blind spot.

Mandatory Security Controls: MFA and Encryption Standards

Every major cyber insurance carrier now requires multi-factor authentication on email, remote access, and privileged administrative accounts. This is non-negotiable. Carriers also expect encryption at rest and in transit for client data, particularly for firms handling healthcare, financial, or personally identifiable information. The 2026 cyber insurance requirements checklist from industry sources confirms that MFA, endpoint detection and response (EDR), and email filtering are baseline expectations. Firms that rely on legacy systems without these controls will either be declined or face exclusions that hollow out the policy.

Incident Response Planning and Backup Protocols

Carriers want to see a written incident response plan that names roles, establishes communication protocols, and identifies pre-approved forensic and legal vendors. They also evaluate backup architecture: specifically, whether backups are immutable, air-gapped, and tested regularly. A firm that backs up to a network-attached drive without offline copies will not satisfy most underwriters. Carriers now expect documented backup testing and recovery time objectives as part of the application process. At Bloc Cyber, we walk firms through the application before submission to identify control gaps that would result in adverse underwriting outcomes.

Cyber Coverage Built for Your Industry

Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.

Field notes from the placement desk.
What carriers are asking right now.