11.5M confidential documents leaked
Mossack Fonseca
Panama, 2016
The Panama Papers leak turned the firm's name into a byword for misconduct. Clients left, and it shut down in March 2018.
< Back
Law firms hold case files, contracts, health records and payment details, and each of them is regulated. This playbook maps the rules that apply to your firm, shows how compliant firms handle client data day to day, and sets out six steps to get there.
Email, file storage and case management are encrypted end to end, so no third party can read case information.
Attorneys open the case files they work on. Paralegals and administrative staff see only what their role needs.
The firm collects only what a matter requires and keeps it in an encrypted document management system.
A PCI DSS-compliant processor stores card numbers as tokens. The firm keeps the last four digits, date and amount, encrypted, access-controlled and audit-logged.
Recorded consultations and meetings are encrypted, tagged, restricted to authorized staff, signed against tampering and deleted on schedule.
Match regulations to your clients and case types, such as HIPAA for health-related cases or GDPR for international clients.
Review your data protection policies, security measures and systems to find vulnerabilities and gaps.
Cover client confidentiality, data security and financial transactions in line with the laws that apply.
Use compliance management systems, secure communication tools and encryption software.
Teach attorneys, paralegals and staff secure data handling, privacy rules and how to avoid conflicts of interest.
Run periodic audits, close the gaps they find and update policies and systems as regulations change.
11.5M confidential documents leaked
Panama, 2016
The Panama Papers leak turned the firm's name into a byword for misconduct. Clients left, and it shut down in March 2018.
13.4M documents leaked in the Paradise Papers
Bermuda, 2016
A cyberattack exposed its clients' tax affairs worldwide. Suing the press kept the story alive, and its reputation for discretion never recovered.
3,600+ lawyers locked out of every system
Global, 2017
NotPetya took down phones, email and the network in 40 countries. Email was gone for six days, and full recovery took almost two weeks.
$200K state fine, after a $100K ransom
New York, 2021
Attackers entered through an Exchange server patched months too late and stole patient data. The firm paid, was fined anyway and put under oversight.
The full playbook tells each of these stories in detail. Read them in the PDF (opens in a new tab)
A free compliance risk assessment shows which rules apply to you and where your systems fall short. Or call us on 718-806-9374.
What HIPAA, HITECH and GDPR require from hospitals, clinics and medical offices, how compliant practices protect patient data, and what a breach really costs.
HIPAA, HITECH, GDPR, State laws, FDA
The rules banks, investment firms, insurers and fintechs answer to, from GLBA and SOX to PCI DSS and AML, with a six-step roadmap and two costly lessons.
Dodd-Frank, GLBA, SOX, PCI DSS, GDPR, AML and KYC
