Cybersecurity in Professional Services Firms: Navigating the Post-Paradise World Cinthia Granados Motley, Member, Dykema Steven Grossman, Vice President of Strategy, Bay Dynamics Paul Poh, Managing Partner, Tixzy Michelle W. Cohen, Partner, Patterson Belknap Webb &Tyler LLP

History of Law Firm Data Breaches Chinese hackers penetrate law firm network for more than one year and steal thousands of emails Law firm targeted by spear phishing emails that are linked to Chinese server “Anonymous” attacks, steals and publicly discloses 2.6 gigabytes of emails from firm that represented soldier who pled guilty in connection with killing of Iraqi civilians “Watering Hole” attack infects law firm website with malware transferred to visitors of web site Hackers infect law firm network with “ransomware” that encrypted firm files until ransom was paid Weil Gotshal and Cravath acknowledge “data incidents” Panama Papers “leaked” (11.5 million documents) from Mossack Fonseca Ransomware attack on DLA Piper Paradise Papers “leaked” (13.4 million documents) from a variety of sources, including Appleby 2008 2011 2012 2015 2016 2017

Law Firms Are Attractive Targets Hold sensitive, confidential client data Mergers and acquisitions Financial information Trade secrets Contract negotiations PHI, PII and other protected information Aggregate valuable information from multiple sources in one place – improves hackers’ ROI Law firms, as service providers, are targets of ransomware attacks Viewed as lagging behind the corporate world in data security

Clients Care Clients request security audits or other verification of security practices Inspection of penetration test results Vulnerability testing by third parties Prohibition or preapproval of cloud services Two-factor authentication Breach notification requirements Indemnification for client breach costs/expenses

Panel Discussion