Texas Law Firms & ABA Rule 1.6(c): Privileged-Client Exposure, IOLTA Wire Fraud & the 2026 Ransomware Reality
Texas law firms hold attorney-client privileged records, settlement escrow, IOLTA trust funds, and HIPAA-adjacent PHI (personal-injury matters, workers' comp). ABA Rule 1.6(c) imposes a duty to make "reasonable efforts" to prevent unauthorized disclosure — in 2025 that means SOC-grade monitoring, not just antivirus. The State Bar of Texas was hit by INC Ransom in January 2025 (1.4M records, including member PII and disciplinary records). The Orrick Herrington & Sutcliffe $8M OCR class-action settlement in 2023 set the new professional-liability data-security standard every plaintiff's firm now cites. If you are a TX-operating law firm, both precedents are already in opposing counsel's brief.
The precedent: every plaintiff's brief in every subsequent law firm breach action cites Orrick's ABA Model Rule 1.6(c) duty-of-reasonable-efforts argument. The settlement amount — $8M+ — is the new floor the professional-liability bar uses to price law firm data-security risk. If your firm's cyber insurance was priced before March 2023, your carrier re-underwrote it after the Orrick ruling.
The standard shift: "reasonable efforts" under ABA Rule 1.6(c) no longer means standard antivirus + periodic patching. Post-Orrick, it means EDR, MFA on document systems, encrypted communications for privileged matters, and an incident-response plan that includes client notification within the ABA FO 483 framework.
Four Law Firm Incidents That Redefined the Risk
INC Ransom — one of the leading ransomware-as-a-service affiliates of 2024–2025 — deployed against the State Bar of Texas in January 2025. The breach exposed 1.4M records including member PII, disciplinary records, and bar exam results. INC Ransom used double-extortion: encryption of systems and publication of data to a dark-web leak site.
TDPSA §541's 30-day cure period was triggered; notifications were issued. The breach is the most damaging direct state-bar compromise in U.S. history and the one every TX law firm now receives a notice about from their malpractice carrier.
Signal for TX firms: the State Bar's membership database — name, bar number, discipline history — is now a high-value targeting list for spear-phishing campaigns against individual Texas attorneys. Every TX-licensed attorney's email address is correlatable from the breach.
A March 2023 breach at Orrick Herrington & Sutcliffe exposed 637,000+ individuals' health plan data and personal data. The breach triggered an OCR investigation and multiple class-action lawsuits. The $8M+ settlement — the largest law firm data-breach settlement at the time — produced a standard: what does "reasonable efforts" under ABA Model Rule 1.6(c) actually mean in practice?
Orrick's settlement documents enumerate the post-breach remediation — EDR deployment, MFA enforcement, encrypted email for privileged communications — that the court accepted as satisfying the "reasonable efforts" standard going forward. These remediations are now the baseline every TX law firm malpractice carrier benchmarks against at renewal.
LockBit affiliates exploited a vulnerability in a third-party managed-file-transfer (MFT) service used by Bryan Cave Leighton Paisner and 80+ other law firms globally. TX-operating Bryan Cave clients in energy, real estate, and private equity had case files and correspondence exposed via the MFT supply chain — without Bryan Cave's own systems being directly compromised.
This is the MOVEit/MFT supply-chain attack pattern: the law firm's internal controls can be excellent, and the breach still happens through a third-party file-transfer service. For TX energy and real-estate firms using any self-hosted MFT service for client document exchange, the Bryan Cave incident is the direct precedent.
Mossing & Navarre, a small personal-injury firm, was hit by a ransomware-as-a-service affiliate that encrypted the firm's entire case file server. Settlement escrow timing was disrupted; opposing counsel had to be notified. The firm had no offline backup, no EDR, and no incident-response plan.
Why it matters for TX firms: personal-injury and workers' comp firms hold the exact combination attackers target — active case file deadlines (creating leverage for rapid ransom payment) and IOLTA trust accounts (secondary BEC target at settlement closing). The Mossing & Navarre pattern is the 2024–2026 template for ransomware affiliates targeting small and mid-size TX plaintiff firms.
The ABA Rule 1.6(c) Compliance Reckoning
ABA Model Rule 1.6(c) states that a lawyer shall make "reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Comment 18 to Rule 1.6 provides eight factors for determining what is "reasonable": sensitivity of the information, likelihood of disclosure, cost of protective measures, difficulty of implementing safeguards, and more. Post-Orrick, "reasonable" is a moving standard — and it moved in 2023.
Texas DR 1.05 is the parallel state-bar confidentiality rule; it carries the same "reasonable efforts" standard and is enforced by the State Bar of Texas Disciplinary Counsel — the same body whose own systems were breached in January 2025.
| Regulatory track | Trigger | Clock | Consequence |
|---|---|---|---|
| ABA Model Rule 1.6(c) + TX DR 1.05 | Unauthorized disclosure of client confidential data | Retroactive — state bar grievance any time after discovery | Disciplinary proceedings; public reprimand; suspension; disbarment |
| ABA Formal Opinion 483 (Oct 2018) | Cyber incident affecting client data | Incident-response obligation: notify affected clients; preserve evidence; remediate | Ethics violation if firm fails to investigate and notify |
| TDPSA §541 (effective Jul 1, 2024) | Breach of personal data of TX residents | 60-day AG notification; 30-day cure period; consumer notice | Up to $7,500/violation per AG enforcement; class action exposure |
| IOLTA wire-fraud — TX IOLTA §171.101–§171.203 | BEC-caused unauthorized wire from client trust account | Immediate — TX State Bar requires self-report + IOLTA reconciliation audit | Potential disciplinary action; malpractice exposure; bar bond claim |
ABA Model Rules 1.6 & 1.15 — What "Reasonable Efforts" Now Means
Rule 1.6 covers confidentiality of information; Rule 1.15 covers safekeeping of client property (including funds in trust). Both rules are interpreted in 2025 to require:
- MFA on all document management systems — Clio, iManage, NetDocuments, PracticePanther, MyCase, any DMS with access to client files
- EDR on every endpoint with access to client files or DMS — plus a documented 30-min SOC response SLA
- Encrypted email for privileged communications — S/MIME or a Proofpoint-equivalent on any matter where the communication is privileged
- Incident-response plan that includes the ABA FO 483 client-notification workflow and a documented IOLTA reconciliation runbook
Comment 18 to Rule 1.6 gives the eight factors courts use when evaluating reasonableness. ABA Formal Opinion 483 (October 2018) adds the incident-response obligation: a lawyer who discovers a data breach must (1) investigate the scope; (2) assess what client information was affected; (3) notify affected clients; and (4) consider notifying law enforcement. Post-Orrick, this opinion is the floor, not the ceiling.
The IOLTA Wire-Fraud Kill Chain
BEC at settlement closing is the most common dollar-loss vector for Texas law firms. Average Houston real-estate-closing wire: $450K–$2M. Reversal window after SWIFT: 24 hours maximum. If the firm does not have an out-of-band wire-confirmation callback policy, the attacker does not need to encrypt a single file — they just redirect the wire.
Step-by-step, the IOLTA wire-fraud kill chain plays out as follows:
- Attacker compromises firm email via phishing or credential stuffing against Outlook / Gmail / M365
- Silent inbox rule set to forward settlement-thread emails and mark-as-read — attorney sees nothing
- Attacker monitors for closing date in attorney-client correspondence and settlement-thread messages
- Day before closing: attacker sends spoofed wire-instruction update from attorney's account (or look-alike domain) to client
- Client wires funds to attacker's mule account at a different financial institution
- Firm discovers the fraud the next day when client asks for closing confirmation
- IOLTA trust reconciliation shows no inbound wire — bar grievance clock starts immediately
The attack requires no malware on the firm's network. It requires only a compromised email account and a firm that does not have an out-of-band wire-confirmation callback policy. The 24-hour reversal window after SWIFT closes before most firms even realize the wire went to the wrong account.
The Case Management Attack Surface
- Clio / MyCase / PracticePanther SaaS credential paths: cloud PMS accounts with reused passwords and no MFA expose the entire client file database with a single stolen credential — no network access required
- iManage / NetDocuments document-server ACL gaps: on-prem DMS instances with overly-broad "authenticated users" ACLs on matter file trees; lateral movement from IT domain reaches DMS server without privilege escalation
- Outlook/M365 shared mailbox credential stuffing: firm-wide shared inboxes (reception@, billing@, settlements@) are the primary target of credential-spray campaigns — no MFA on shared mailboxes is common
- VPN for remote associates and paralegals with no MFA: legacy SSL-VPN accounts provisioned pre-pandemic, never rotated; a single password spray exposes the full firm network
- Opposing counsel or expert witness portals: extranet portals used for case document exchange (ShareFile, NetDocuments external share) with no MFA and no session timeout are the MOVEit-pattern attack surface
- IOLTA trust account bank portal: online banking portals for trust accounts are often protected by username + password + SMS OTP — a SIM-swappable second factor that does not satisfy the IOLTA out-of-band confirmation standard
8 Controls for Texas Law Firms
30/60/90-Day Hardening Roadmap
- MFA on M365, DMS (Clio / iManage / NetDocuments), VPN
- IOLTA wire-confirmation out-of-band callback policy — in writing, firm-wide
- EDR deployment on all endpoints with DMS / matter file access
- Outlook inbox-rule audit: scan all user accounts for silent forward rules
- iManage / NetDocuments ACL review — remove "authenticated users" ACLs on matter file trees
- Privileged email encryption rollout (S/MIME or Proofpoint)
- TDPSA §541 data map draft — enumerate all client PII in DMS / PMS
- ABA FO 483 incident-response plan documented and reviewed by outside ethics counsel
- Full identity segmentation — DMS service account OU; no lateral path from associate desktop to DMS admin
- External-portal MFA enforced (ShareFile, NetDocuments external share, expert witness portals)
- Annual IOLTA reconciliation audit; TX IOLTA §171.101–§171.203 self-report procedure documented
- CoreRecon SOC quarterly threat hunt; TX DR 1.05 compliance artifact delivered to managing partner
CoreRecon Covers Texas Law Firms
$89–$129/endpoint · $2,500+/mo Command tier · 30-min IR SLA · SDVOSB-certified · TX-resident SOC
View the TX Law Firms Security Page →