Ransomware attack on law firm creates complex challenges

A law firm currently dealing with a ransomware attack is facing a range of operational, legal, ethical, and evidentiary challenges. Much of the data involved is protected by professional secrecy, which limits the ability to share details about the breach.

Ransomware attacks are increasingly common in 2025

In 2025, the French National Cybersecurity Agency (ANSSI) recorded 128 ransomware attacks, with nearly half of the victims being small and medium-sized enterprises or ETIs—businesses that include most law firms. These attacks pose significant risks to both data integrity and operational continuity.

Immediate steps to contain the attack

In the first hour after the attack is detected, the priority is to isolate affected systems from the network and disconnect them from the Internet. It is important not to shut down affected machines immediately, as critical data may only be accessible in memory, which can be preserved through hibernation.

First thirty minutes focus on containment

The first thirty minutes should be dedicated to identifying affected equipment and disconnecting them from the network. It is crucial to avoid immediate restoration or cleaning of all machines, as these actions can be handled later. Containment must come before contacting the insurer, as many cyber insurance policies require the use of a designated incident response provider.

Preserving evidence in the first three hours

From H+1 to H+3, the focus shifts to preserving digital evidence. All important actions must be recorded in real-time, including the identification of ransom requests, server isolation, backup disconnection, and contacting the insurer and IT service provider. A parallel register should be maintained to document the handling of media, ensuring traceability of digital evidence.

Working with IT and forensic experts

The IT service provider and forensic investigation must collaborate closely. Forensic teams should prioritize preserving attack traces, as reinstalling systems or removing malicious software can destroy critical evidence. In cloud-based operations, audit logs are the primary source of evidence, and their immediate export is crucial to avoid potential data loss.

Understanding the breach within 72 hours

From H+3 to H+72, the investigation focuses on understanding the breach. This involves reconstructing the entire chain of compromise, including how the attacker entered the system, when, with which account, and whether they obtained administrator privileges or compromised the cloud environment.

Distinguishing data risks and legal requirements

The investigation must distinguish between the availability, integrity, and confidentiality of data. Under the General Data Protection Regulation (GDPR), a register of processing activities can be a critical tool in crisis management. However, the absence of evidence for data exfiltration does not prove it did not occur.

Meeting legal deadlines and managing professional secrecy

Two 72-hour deadlines apply: one for filing a complaint with the insurer and one for notifying the CNIL under the GDPR. These deadlines must be met, and the firm must determine whether personal data are involved, whether it is the data controller or a subcontractor, and whether individuals are at risk. Professional secrecy complicates the response but does not prevent the investigation.

Filing a complaint with authorities

Filing a complaint with the appropriate authorities is essential, with the firm acting as the victim. Required documents include the ransom message, a timestamped chronology of events, and identification details of the attacker. The complaint must be filed before the investigation is complete to avoid losing insurance coverage.

Restoring systems after 72 hours

From J+3 to J+7, the focus is on restoring systems. Paying the ransom is not recommended, as it does not guarantee the decryption of files or the deletion of stolen data. Restoration must be gradual, ensuring that the causes of the compromise are addressed before returning systems to full operation.

Ten key steps for effective response

The ten reflexes to follow include isolating compromised machines, protecting backups, avoiding unnecessary shutdowns, contacting the insurer and IT service provider, using alternative communication channels, keeping a precise chronology, preserving logs, securing accounts from a healthy environment, assessing legal obligations, and restoring only after the compromise is understood and contained. Speed does not replace method, and structured preparation is essential for an effective response to a ransomware attack.