Mailbox Compromise, Automatic Destruction and a Departing Fee Earner

1. Contain, but preserve. Reset the partner's credentials, revoke active sessions and tokens, disable the external forwarding rule, and isolate the mailbox without deleting anything. Block the destination domain at the perimeter. Containment stops ongoing loss; preservation keeps the evidence you will need to determine notification scope. Deleting the mailbox to 'clean up' destroys the very records that tell you which clients are affected.

2. Establish scope before communicating. Pull mailbox audit and message-trace logs: which messages, to which address, when, whether the external account was accessed, and whether any replies came back. Identify the clients, the matter types and the categories of data. The settlement offer is the highest-risk item because of the potential litigation prejudice, so it needs separate, immediate attention from the relationship partner.

3. Convene the decision group. Managing partner, the person responsible for data protection compliance, IT, insurer and external counsel as needed. Assign a single incident owner and a single communications owner. Instruct external counsel early enough to consider privilege over the investigation where that is available and appropriate.

4. Assess obligations and notify. Whether and whom to notify depends on jurisdiction, the data involved and any contractual notification clauses with clients. Notify the insurer in line with policy terms, and consider whether a criminal report is appropriate. Do not notify clients before the facts are reasonably established, but do not drift past required timelines either; if the assessment will take time, send a holding notice where the law or the contract allows.

5. Remediate and review. Mailbox rules audit, phishing-resistant multi-factor authentication, link isolation, and a rule that alerts on new forwarding rules. Post-incident review with actions and owners.

What not to do yet: do not wipe devices, do not send a blanket client email drafted by IT, and do not put anything about the settlement offer in a general communication.

Immediate steps. Suspend automated destruction across the firm today. Reconcile the fee earner's notebook against the system to identify every matter with an actual or reasonably anticipated hold, and record each one in a central hold register with an owner and a review date. Determine what the 2019 run actually destroyed, when, and on whose authority, and document that chronology - the firm needs an accurate account of what happened before it decides what to say about it.

Assess recovery. Daily snapshots for 90 days may allow restoration of some or all destroyed files. Restore conservatively: restore the identified held matters rather than reinstating everything, because bulk restoration creates its own confidentiality and data-minimisation problem and undermines the policy. Get advice on whether the destruction creates exposure in the affected matter and on how to disclose it.

Diagnose the real failure. The policy was not the problem. The problem is that holds lived in a person's notebook rather than in the system, and destruction ran on a timer with no hold check. That is a control design failure, not an individual error.

A defensible deletion process:

• A written schedule by matter type, with retention periods and the legal or regulatory basis for each.
• Destruction triggered by system logic, not by an individual's memory, with a pre-destruction report reviewed by a named records owner.
• A hold flag that overrides the schedule, set the moment litigation or investigation is reasonably anticipated, not when proceedings are served.
• A hold register listing matter, reason, scope, custodian, set-by and review date, reviewed at fixed intervals.
• An audit log of every destruction event, retained so the firm can prove what was destroyed when and under which authority.
• Annual certification by practice group heads that they have no unrecorded holds.

Immediate actions.

1. Confirm what happened: which files, whether the upload completed, whether the drive is personal or firm-managed, and whether it has been shared with anyone.
2. Revoke all remaining access for the leaver - email, document management, cloud collaboration, remote access - and check for any other active sessions or forwarding rules.
3. Instruct the individual in writing to delete the copies and confirm deletion in writing. Where the device is firm-managed, use remote wipe for firm data after preserving anything needed for the investigation.
4. Assess risk: do the 4,000 files include confidential client material, privileged advice, personal data or anything belonging to a client with specific contractual security terms? That assessment drives whether clients must be told.
5. Escalate to the managing partner and take advice on professional conduct and any notification duties. Treat this as a data incident until it is shown not to be.

Why this happens. The leaver almost certainly believed they were being helpful; handover routinely creates pressure to copy the whole file. If the sanctioned handover route is slow or unclear, bypass is predictable. Fix the route, not just the person.

Prevention:

• A leaver checklist jointly owned by HR, IT and the supervising partner, with fixed timing: notify IT at notice, reduce access to need-to-know during notice, full revocation on the last working day.
• A documented handover protocol using a shared matter workspace, so nothing needs to be copied out.
• Alerts on bulk downloads and uploads to unsanctioned cloud services, and blocking of personal storage destinations.
• Device return and a recorded check before final pay or reference is settled.
• An exit attestation covering confidentiality and return of materials, signed on the last day.
• Periodic access reviews so that people hold only the matters they are working on, which also caps the size of any future leak.