Only some security risks are covered by LPLC’s professional indemnity insurance. Cybersecurity risks come in many forms and only some of them are covered by LPLC’s professional indemnity insurance policy.
What's on this page?
In essence, the policy covers any civil liability resulting from a claim made against a practitioner by a third party in connection with the firm’s legal practice and any defence costs associated with that claim.
Any claim that a practitioner makes on the policy must be considered on its merits and subject to all of the terms and conditions of the policy. Set out here are claims likely to fall within the scope of the insuring clause and those which are not.
Fake emails
Email based cyber-attacks are a primary way in which cyber-criminals breach law firm networks. Attack vectors such Business Email Compromise, phishing, and malware delivery consistently remain top causes of claims to the LPLC.
Any money paid to a fraudster as a result of a fake email will be covered by the policy as the client will be seeking to recover the amount from the firm.
The typical scenario is the fake email supposedly coming from the client instructing the lawyer to deposit money in the fraudster’s account. To avoid these claims firms should establish a strict procedure on how payment details are to be shared between the firm and client (preferably written in hard copy) and the clients should be reminded about the procedure at multiple times throughout the matter. The procedure for payment should include a ‘call before you pay’ step ensure that everyone follows this any time a payment is to be made.
Ransomware attack
Cyber-attacks that shut down a firm’s computer system and interrupt the productivity of the firm resulting in lost income would not be covered by the policy. However, if, the shut-down resulted in the firm missing a deadline on a client matter and the client suffered loss, any claim for compensation by the client would give rise to a civil liability indemnifiable under the policy.
If the firm paid the ransom to unlock its computer system, that payment would not be covered as it is not a civil liability. Similarly, any cost paid to obtain technical advice from IT specialists would not be covered.
Loss of confidential information
Where a cyber-attack results in confidential client information being stolen there are different possible outcomes. For example, the use of the confidential information may result in the client suffering a loss. If the client claims that loss from the firm the policy will cover that claim. Or, the client may make a misconduct complaint to the Victorian Legal Services Board and Commissioner for allowing the confidential information to be disclosed. That complaint is not covered by the policy unless the complaint also includes an allegation of negligence and a claim for compensation.
