Five Million Dollars a Breach, and Fewer Firms Are Insured

Published sector statistics put the average cost of a data breach at a law firm at $5.08 million, an increase of around 10% year on year, while the proportion of firms carrying cyber liability insurance fell from 46% to 40%.

The normal relationship is that rising loss drives rising uptake. Here the cost went up and the cover went down.

The available explanations are all uncomfortable. Cover may have become unaffordable or unobtainable for smaller firms as underwriters tightened terms. Firms may have declined cover whose security preconditions they could not meet. Or the profession may simply be judging the risk to be someone else’s.

This desk cannot distinguish between them from the material available, and says so rather than picking the most quotable.

A firm’s document store contains its clients’ merger plans, litigation strategy, regulatory correspondence, internal investigations and settlement terms — material assembled precisely because it is the most sensitive thing each client has.

It is the concentration structure this database records everywhere, applied to a category of information selected for maximum consequence. And it sits in organisations that are frequently small partnerships without a dedicated security function.

A forty-partner firm may act for organisations with tens of thousands of employees and full security teams. The client’s vendor assessment will ask the firm to demonstrate controls proportionate to the data, and the firm’s revenue does not support them.

That is the funding gap filed at 26-0729 and 25-0918, in the private sector: the party best placed to protect the material cannot afford to, and the party that can afford to has handed the material over.