Between professional secrecy and digital threat: Confidentiality under digital siege
Summary: The article analyses the major cyber risks threatening lawyer-client confidentiality in the digital age, highlighting how the lack of minimum IT security measures turns a fundamental principle of the profession into an exploitable vulnerability. From ransomware and phishing attacks to breaches in official platforms of the profession, threats are increasing, while Romanian legislation remains silent. The authors propose essential technical measures and a set of collective actions that UNBR and the bar associations should implement to protect client trust. In a digital ecosystem, defending confidentiality is no longer a moral option, but an urgent technical obligation.
Keywords: lawyer-client confidentiality, cyber security, cyberattacks, Legea 51/1995 (Law no. 51/1995), lawyers' digital obligations, backup, encryption, MFA, right to confidentiality, data breaches in the legal profession, digitalisation in justice
A vulnerable sanctuary
For centuries, confidentiality between lawyer and client was an almost sacred edifice. Like the silence of a confessor or the discretion of a psychologist, the lawyer's silence guaranteed an inviolable space. Today, however, the sanctuary has moved to the cloud. And the brick walls that once guarded the locked metal cabinets holding files on rails have been replaced by web tools and applications - most often easily compromised.
Working with IT experts, I have come to understand just how fragile the working environments that all lawyers consider to be "secure" really can be. No man-made program, system or piece of equipment is infallible, and every line of code may contain a vulnerability that has yet to be exploited, while a seemingly innocuous email can sometimes be the recipe for a small legal disaster.
In the last 12 months alone, I have come across dozens of cases in which professionals from regulated fields - predominantly in finance and accounting - have fallen victim to cyberattacks such as ransomware, phishing, DoS/DDoS or even man-in-the-middle attacks, resulting in the exfiltration of data and information and the theft of confidential documents. Some found out too late, others were forced to pay dearly. Most, however, did not know what had happened to them, or how to react.
Today, and even more so in the future, a lawyer's first line of defence is no longer the courtroom, but digital infrastructure: strong passwords, multi-factor authentication, backups, encryption. Client confidentiality no longer depends solely on the professional oath, but also on maintaining a minimum level of digital hygiene.
Alarming figures from the West and shadows from the East
A recent study by Proton shows that 1 in 5 law firms in the US has been the victim of a cyberattack in the past year, and 8% of these have suffered losses of confidential data[1]. More seriously: 65% were unaware of the legal obligations regarding breach notification. This despite the fact that those American firms have large budgets, in-house IT teams and regular audits.
What does this mean for the legal profession in Romania, where most professionals' IT infrastructure amounts to little more than free applications installed on their phones and laptops? The symptoms are already evident, and the experiences of other regulated professions, such as auditors and accountants, should serve as a clear warning to lawyers. There are dozens, if not hundreds, of examples of audit and accounting firms that have fallen victim to ransomware: encrypted servers, locked files, stolen data. Amounts demanded: between EUR 10,000 and EUR 100,000 in cryptocurrency. Not in New York, Silicon Valley or London, but right here at home.
And if another wake-up call were needed: in January 2024, a young IT specialist discovered that the Tabloul Electronic al Avocaților (Electronic Register of Lawyers) publicly exposed the personal data of more than 37,000 Romanian lawyers. National ID numbers, addresses, contact details - all indexed on Google. The platform of the very institution meant to protect the profession had a latent technical vulnerability for years[2]. In the age of speed, preserving confidentiality is no longer merely an ethical principle, but an urgent cyber challenge.
Anatomy of a subtle, progressive and irreversible attack
The Luna Moth group - flagged in an FBI report - compromised dozens of law firms in the US in 2025. Not through spectacular exploits, but through social engineering tactics. Emails that appeared to come from the IT team: fake meeting requests, disguised links, persuasive messages[3].
Once inside, the attacker:
- copies the data (not just encrypts it); - demands ransom, threatening to publish it on the darknet; - contacts clients or opposing parties, to increase pressure.
In a recent case in the UK, the firm DPP Law lost 32 GB of data. Hackers gained access through an admin account not protected by MFA. The firm reported the breach 43 days after the incident. This was followed by a £60,000 fine from the supervisory authority - the ICO - and, far more seriously, a snowball effect that led to irreversible reputational damage[4].
Romania: where the law is silent, the vulnerability speaks loudly
Legea nr. 51/1995 (Law no. 51/1995) on the organisation of the legal profession and the Statute of the legal profession do not mention the term "date" except in the sense of "the lawyer's personal data" or "personal data" in a generic sense. Extensive reference is made, however, to professional secrecy, which is an absolute, time-unlimited obligation of public order, and art. 46 para. (4) of Legea nr. 51/1995 (Law no. 51/1995) provides that unjustified disclosure of client secrets constitutes a criminal offence.
There are no clear legal obligations for lawyers regarding:
- periodic security audits; - protection of client data through encryption; - civil liability for digital leaks.
The result? Each professional manages their own risks. Some work through WhatsApp, Yahoo or Gmail. Others through Dropbox accounts without multi-factor authentication. Worryingly few lawyers have isolated backups, end-to-end encryption, access policies or incident response plans.
It is fertile ground for professional hazard: the client believes they are protected, while the lawyer only finds out they are not when it is already too late.
Security as professional diligence
There are five essential measures that should become the minimum standard for any lawyer:
1. multi-factor authentication (MFA) across any working environment - email, cloud, VPN; 2. encryption of sensitive files and professional communications (email + messaging); 3. offline backups and tested restoration procedures; 4. differentiated access policies (“need to know”); 5. an incident response plan and annual simulations.
The costs? Infinitely lower than the consequences of a successful attack. Just think of the fee lost from a major client who finds out that their data has been compromised.
What the profession can (and must) do
In seeking to act as architects rather than firefighters, UNBR, the bar associations and major law firms must take on an active role:
1. developing a National Cybersecurity Guide for lawyers; 2. imposing mandatory minimum technical standards (MFA, encryption, backup); 3. including at least 2 hours of mandatory annual cybersecurity training; 4. developing clear and rapid channels for reporting incidents to bar associations and UNBR, for support and prompt intervention in the event of a breach; 5. actively promoting awareness of digital risks through periodic information campaigns aimed at the profession.
Earning the trust placed in us
The legal profession is built on trust, which carries the obligation of a constant anchoring in reality. And the reality is that hackers are better organised, better funded and - often, if not always - far better prepared than we are.
In a digital age, and amid an expansion of emerging technologies, the confidentiality of the profession cannot remain a mere promise - it must be turned into real infrastructure.
We have a duty to be not only good defenders of our clients' interests, but also guardians of the data entrusted to us. And client trust must now be defended with digital tools, not merely with solemn words.
[1] Proton, “Cyberattacks hit 20% of law firms last year: Here's how to stay safe”, 2025, available at aici [2] Profit.ro, “The portal of Bucharest lawyers, shown to have security breaches by a student”, January 2024, available at aici [3] The Hacker News, “FBI Alerts Law Firms to Luna Moth's Phishing Campaign”, May 2025, available at aici [4] ICO UK, “Law firm fined £60,000 following cyber attack”, April 2024, available at aici
Lawyer Victor Buju, Buju Stanciu & Asociații Lawyer Alin Nichifor, Buju Stanciu & Associates