An employee receives an email that appears to come from Microsoft. There's a problem with the employee's account. They need to sign in. The employee clicks the link, sees what appears to be a familiar Microsoft 365 login page, and enters their email address and password. Then they realize something doesn't look right. What happens next?
For a law firm, the answer shouldn't depend entirely on whether the employee knows what to do or whether someone from IT happens to be available. Phishing is one of the cybersecurity risks every law firm should be preparing for. Even security-conscious employees can encounter convincing messages. That's why a law firm's cybersecurity strategy shouldn't stop at teaching employees not to click suspicious links. The firm should also be prepared for what happens after someone does.
First, Don't Turn Phishing Into an Employee Blame Exercise
Security awareness training is important. Employees should know how to recognize suspicious links, unexpected attachments, unusual requests, fake login pages, and other common warning signs. But training does not make people immune to phishing.
Attackers intentionally create messages designed to look legitimate. They may imitate Microsoft, a bank, a file-sharing service, a client, a colleague, or a senior member of the firm. Some create urgency. Others arrive at exactly the right moment to blend into the employee's normal workday.
If employees believe they'll be embarrassed or blamed for reporting a mistake, they may hesitate. That lost time can matter. A much better culture is: If something seems wrong, report it immediately. The sooner the firm knows about a potential compromise, the sooner someone can determine what happened and respond.
Clicking the Link Doesn't Necessarily Mean the Account Was Compromised
It's important to distinguish between different events. An employee who merely receives a phishing message is different from an employee who clicks a link. Clicking a link is different from entering credentials. Entering credentials is different from approving a fraudulent multifactor authentication request. Opening a malicious attachment may create another type of risk entirely. That's one reason employees shouldn't try to diagnose the situation themselves. They should report what happened and let the appropriate people investigate. The response should be based on what actually occurred.
If Credentials Were Entered, Time Matters
Suppose an employee enters their Microsoft 365 credentials into a fake login page. Those credentials may now be available to an attacker. The immediate objective is to prevent or terminate unauthorized access and determine whether the account has already been used. The exact response will depend on the circumstances, but IT or the firm's security provider may need to take actions involving the account, active sessions, authentication credentials, sign-in activity, security settings, and other parts of the environment. This is one reason Microsoft 365 security for law firms needs to involve more than simply enabling accounts and assigning licenses.
There may also be questions that need investigation. Did anyone successfully access the account? From where? Was anything changed? Were suspicious messages sent? Were files or email accessed? Did the attacker attempt to establish another way into the account? The faster the incident is reported, the sooner that investigation can begin.
Multifactor Authentication Helps, but It Doesn't Eliminate Phishing
Multifactor authentication adds an important layer of protection. If an attacker steals a password, another authentication requirement can help prevent that password from being enough to access the account. But firms shouldn't conclude that phishing no longer matters once MFA is enabled.
Attackers continually adjust their methods. Employees can also be tricked into approving authentication requests or interacting with convincing login experiences. The larger lesson is that cybersecurity shouldn't depend on one protective control. MFA matters. So do email security, identity protection, employee awareness, monitoring, secure configuration, and incident response. Security works best in layers.
A Compromised Mailbox Can Create a Second Wave of Attacks
Imagine an attacker successfully gains access to an attorney's email account. The risk may extend beyond the information already inside the mailbox. The attacker may now have something extremely valuable: A trusted identity.
An email sent from a real attorney's account may be far more convincing than an obvious phishing message from an unfamiliar address. An attacker could potentially use that trust to target other employees, clients, vendors, or business contacts. That makes compromised email particularly concerning. An internal technology problem can quickly become a problem involving other people who trust communications from the firm.
Attorneys' Mailboxes Can Contain Valuable Context
Think about what exists in a typical attorney's mailbox. Client names. Conversations. Appointments. Attachments. Information about transactions or matters. Contact information. Messages from other attorneys. Billing discussions. Potentially sensitive or confidential information.
Even when an attacker isn't looking for one specific document, access to those communications can provide context that makes future fraud or impersonation attempts more convincing. Cybersecurity is therefore not simply about protecting a password. It is about protecting confidential client information from cybersecurity threats, as well as protecting the trust that an attorney's account represents.
Someone Should Know What to Do Before the Incident Occurs
A phishing incident shouldn't trigger a discussion that begins with: "Who handles this?" Employees should know how to report a suspicious email or possible compromise. Your IT provider should have an escalation process. Someone should be responsible for evaluating what happened and taking appropriate action.
Firm leadership should know how larger security incidents are handled and when additional parties may need to become involved. The precise response will vary depending on the incident, but the responsibilities shouldn't have to be invented in the middle of it. This is one of the reasons an incident response plan should be part of a broader cybersecurity strategy for law firms.
Your IT Provider Should Be Able to Investigate, Not Just Reset the Password
A password reset may be necessary after a suspected credential compromise. But it shouldn't automatically be the end of the investigation. The larger question is: What happened while the account may have been exposed?
Depending on the incident, your provider may need to review available security information, determine whether unauthorized access occurred, look for suspicious activity, verify that account settings haven't been improperly changed, and identify whether further action is necessary.
Closing the support ticket because the employee can log in again isn't the same as determining whether the incident has been contained.
Training Should Teach Employees How to Respond, Not Just What to Avoid
Security awareness training often focuses heavily on prevention: Don't click suspicious links. Don't open unexpected attachments. Check the sender. Be cautious about urgent requests.
Those lessons are important. But employees should also be taught what to do when something goes wrong. For example: "I clicked a suspicious link." "I entered my password before I realized the page might be fake." "I approved an authentication request I didn't initiate." "I opened an attachment and something strange happened."
The employee's next action should be clear. Fast reporting gives the people responsible for security more time to respond.
Run the Scenario Before You Need It
Law firm leaders don't need to conduct complicated cybersecurity exercises to learn something useful. Try asking this scenario at your next technology or security review: "An attorney tells us they entered their Microsoft 365 password into what now appears to be a phishing site. What happens next?" Then listen carefully to the answer. Who does the employee contact? Who responds? What immediate actions are taken? How do you determine whether the account was accessed? Who investigates what happened? What happens if client or firm information may have been affected? How is firm leadership kept informed? The purpose isn't to catch your IT provider off guard. It's to find out whether the firm has a process.
The Goal Isn't to Make Every Employee a Cybersecurity Expert
Attorneys and staff already have jobs. They shouldn't need to analyze email headers, investigate login activity, or understand every new phishing technique. They do need enough awareness to recognize that something may be wrong and enough confidence to report it quickly. The technical investigation belongs with the people responsible for cybersecurity. That's a healthier division of responsibility.
Employees recognize and report. The appropriate technical team investigates and responds. And firm leadership makes sure those responsibilities are established before an incident occurs.
Production Ready IT for Law Firms
At Everleap IT, we believe technology entrusted with confidential client information and critical legal work should be operated, not merely supported. That's the idea behind Production Ready IT.
For more than 20 years, we've operated production hosting environments where security monitoring, incident response, resilience, and proactive management are everyday operational requirements. We bring that same operational mindset to managed IT and cybersecurity services for law firms.
Today, Everleap IT provides managed IT and cybersecurity services to law firms throughout Southern California's Inland Empire, including Rancho Cucamonga, Ontario, Upland, Chino, Claremont, Riverside, and nearby communities.
For law firms, cybersecurity isn't about assuming nobody will ever click the wrong link. It's about putting multiple layers of protection around the firm and being ready to respond when something gets through.
Would Your Firm Know What to Do?
Ask your IT provider this question: "What happens if one of our attorneys enters their Microsoft 365 credentials into a phishing site tomorrow morning?" If the answer is clear, that's valuable. If the answer begins with figuring out who should handle it, that's valuable information too.
Your firm doesn't need a plan for every possible cyberattack. But it should know who takes responsibility when a potential security incident occurs and what happens next. If you'd like to discuss your firm's cybersecurity readiness, schedule a Technology Strategy Call with Everleap IT. We'll learn about your firm, your technology, and the security and operational challenges standing in your way.
Not ready for a conversation? Download our IT Buyer's Guide to help evaluate whether your firm's technology and cybersecurity are being proactively managed.
