The Phished Inbox and the Missing Retainer

Contain and preserve

1. Disable the compromised email account, revoke active sessions, reset passwords and enforce multi-factor authentication. Isolate any device that may be infected; do not wipe it before forensic images are taken.
2. Preserve logs and evidence. Keep email logs, cloud access records, WhatsApp exports relevant to the matter and the compromised machine. A cover-up destroys the firm's ability to explain what happened and may amount to obstruction.
3. Engage an IT forensic provider to establish what was accessed, when and by whom. Change credentials for the cloud account and remove the free-drive service from client use.

Assess the data

The medical records are sensitive personal data under the Data Protection Act, 2012 (Act 843). The witness statement is confidential litigation material. The firm must identify every client affected, not only the two obvious ones, and assess whether the attacker has exfiltrated or published anything.

Notify

• Affected clients: tell them promptly and factually what happened, what data was involved and what the firm is doing. Do not wait for the court or the IT fix.
• Data Protection Commission: consider notification; the Act imposes security obligations and the Commission expects serious incidents to be reported. Take advice, but do not assume silence is acceptable.
• Police/Cyber Crime Unit: report the phishing and any extortion demand.
• Professional indemnity insurer: notify immediately; late notice can prejudice cover.
• The court: if the compromised material affects the commercial case, the firm must consider disclosure to the court and to the other side, not 'deal with it later'.

Litigation hold first. Suspend deletion and alteration of all documents, emails, WhatsApp messages and backups relating to both matters. The firm's duty to preserve arises now, not when the court orders it.

The witness statement. Establish whether the attacker copied, altered or deleted it. Recover the original from backups or the author's device; verify its integrity and metadata. If the version served or relied on may have been compromised, tell the client and, if material, the court. Do not serve a reconstructed statement as if it were the original without explaining the provenance.

The missing retainer. The absence of a signed retainer affects proof of the terms, not necessarily the existence of the retainer. Reconstruct the file from emails, attendance notes, invoices, bank records and the client's own correspondence. Ask the client for their copy. If no signed document exists, record the terms in a contemporary note and regularise the retainer now. For the discovery exercise, disclose what exists and explain the gap candidly; a court is usually more concerned with candour than with a perfect filing system.

The water-damaged 2013 files. Salvage and freeze the damaged boxes, photograph them, list what is legible and what is lost, and scan the salvageable documents. Check the firm's retention policy and any legal hold before destroying anything. If a document is lost, say so in the affidavit or disclosure statement; do not reconstruct a document and present it as an original.

Discovery. Prepare a proper list of documents, claim privilege where appropriate, and apply for directions if the firm cannot comply in seven days. The worst course is to file a misleading affidavit and hope the gap is not noticed.

Approved systems only. Client work should be stored on a firm-controlled, encrypted cloud or server with access controls, audit logs and backups. Personal laptops, personal email and free cloud drives should be prohibited for client data. If a personal device is used, it must be enrolled in the firm's device-management system and encrypted.

Replace WhatsApp case groups. WhatsApp is not a document-management system. Use a firm-approved secure messaging or client-portal tool that keeps a record, controls membership and allows archiving. If WhatsApp is used for urgent updates, ensure substantive documents are saved to the file and that no client confidences are discussed in group chats with non-lawyers.

Email security. Multi-factor authentication, phishing training, attachment screening and a rule that no one approves a password reset or payment change without independent verification. Test the firm's response with a simulated phishing exercise.

Access control. Role-based permissions: juniors should not have access to the whole firm's files, and a departing lawyer's access should be revoked the same day. Keep an access log and review it quarterly.

Records management. A written retention schedule; a file index; a secure, dry records room with environmental monitoring; digitisation of old files; and a disaster plan that includes salvage and backup. Do not use cheap storage for original client documents.

Incident response plan. Name a response team, keep an incident register, and set out who notifies clients, the insurer, the Data Protection Commission and the court. Train staff annually and test the plan. The managing partner should report on compliance at every partners' meeting.