In today’s digital landscape, the legal profession operates under unprecedented exposure. Attorneys and members of the judiciary now face heightened risks of cyber intrusion, identity theft, and personal security threats that extend well beyond traditional notions of professional liability. Events such as the Panama Papers and the cyberattack involving DLA Piper reveal how breaches affecting legal professionals can undermine institutional integrity, public confidence, and the rule of law itself. From a practitioner’s perspective, this article examines what it means to practice law in an era where data vulnerability and threats to one’s identity has become a matter of personal safety, professional identity, and democratic resilience.
By Sally Ann Vazquez-Castellanos, Esq.
Published on January 3, 2026.
This morning’s chat with generative AI became a reflection on how incidents from the Panama Papers to the DLA Piper cyberattack reveal growing cybercrime, identity theft, and personal security risks confronting attorneys and the judiciary—risks I have personally experienced through a variety of threats affecting my own work and professional identity.
In 2016, the Mossack Fonseca law firm—later revealed in the Panama Papers—demonstrated how lapses in basic cyber hygiene can evolve into a global crisis. Reportedly, investigations showed that the firm’s website and client portal were running outdated WordPress and Drupal versions, including vulnerable plugins, unpatched systems and weak configurations. These deficiencies were not only technical errors but became a compliance and governance nightmare.
Fast-forward to 2025, cybercrime and the targeting of attorneys, judicial officers, and their family, friends and staff remains one of the most significant challenges facing American jurisprudence today.
The ABA Standards and the Meaning of “Reasonable Security”
For law firms and professional service providers, cybersecurity failures carry ethical implications. Under the American Bar Association Model Rules, lawyers must take “reasonable efforts” to prevent unauthorized access to client information (Rule 1.6(c)) and maintain competence in relevant technology (Rule 1.1 Comment 8). Supervisory duties under Rules 5.1 and 5.3 extend those obligations to staff and third-party vendors.
The ABA’s 2017 Formal Opinion 477R and later guidance define reasonable security as a process rather than a product. What counts as reasonable depends on:
The sensitivity of the data involved. The likelihood of unauthorized access or disclosure. The cost, difficulty, and feasibility of protective measures. The impact of safeguards on a lawyer’s ability to serve clients.
In practice, this means maintaining an ongoing risk-management cycle—inventory, assessment, mitigation, monitoring, and documentation. A law firm that neglects patching or fails to supervise a vendor’s update practices is not meeting that standard.
Applying the Standards to CMS and Plugin Governance
When a firm or company relies on a content-management system such as WordPress, its duty of care extends to every plugin, theme, and third-party integration. Practical measures include:
Maintaining a complete system inventory of all components and their versions. Assessing risk for each plugin or theme, considering exposure and vulnerability history. Implementing strict patch-management procedures with defined time-to-patch goals. Requiring vendor warranties and update commitments in all technology contracts. Restricting administrative access and enforcing multi-factor authentication. Preparing and testing incident-response plans for potential breaches. Documenting every security decision for compliance and defense purposes. Training personnel and contractors on safe update and deployment practices.
These actions align directly with ABA expectations and emerging “reasonable security” requirements in state breach laws, such as California’s Civil Code § 1798.81.5.
Why It Matters
The parallels between Mossack Fonseca’s unpatched infrastructure and today’s mass-exploitation campaigns are unmistakable. Whether a firm handles offshore financial data or a nonprofit manages donor lists, the failure to patch or monitor software can trigger statutory liability, breach-notification duties, and professional-conduct violations.
Reasonable security is no longer aspirational—it is the baseline for ethical and regulatory compliance. Be wary—what is reasonable is often a matter of context.
Sources
WIRED — “The Security Flaws at the Heart of the Panama Papers.” https://www.wired.com/story/panama-papers-mossack-fonseca-website-security-problems/accessed January 3, 2026 at approximately 11:59 a.m.
American Bar Association — Formal Opinion 477R (2017); Model Rules 1.1, 1.6, 5.1, 5.3; “Reasonable Security Measures: The Next Focus in Data Breach Litigation” (2022) Center for Internet Security — “Reasonable Cybersecurity.”
This publication is intended for informational purposes only and does not constitute legal advice.