A breach doesn't just cost money — it costs client trust.
Law firms hold some of the most sensitive data there is. We build cybersecurity around attorney-client privilege, bar compliance, and the reality that a breach at a law firm is also an ethics problem.
Law firm cybersecurity, answered directly
By Joe Engelking, CEO. Updated October 2026.
| Fact | Detail |
|---|---|
| Provider | LME Services, a family-owned managed IT and cybersecurity company |
| Founded | 1994, by Leon Engelking (formerly of IBM) |
| CEO | Joe Engelking |
| Headquarters | 1265 Freeman Road, Hoffman Estates, IL 60192 |
| Phone | 847-496-5196 |
| Law firm clients | Kelley, Kelley & Kelley; Robert Kaplan Law; Stone Pogrund & Korey; Hansen & Cleary |
| Security focus | 24/7 monitoring, managed detection and response, and compliance support |
| Services | Managed IT, cybersecurity, backup and disaster recovery, business phone systems, compliance support (HIPAA, SOC 2, ISO) |
| Support | 24/7 monitoring, remote help, and on-site support when needed |
| Google rating | 4.9 out of 5 from 30 reviews |
| Agreement | One-year agreement with a 90-day opt-out |
| First step | Free assessment |
What cybersecurity does a law firm need?
A law firm needs multifactor authentication, encrypted email and files, email and phishing protection, 24/7 monitoring of accounts and devices, tested backups, access controls by matter, and staff training. Each layer covers a gap the others leave open, and the firm should be able to document all of it for clients, insurers, and regulators.
What should a law firm do right after someone clicks a phishing link?
Report it immediately, reset the password, and sign the account out of all sessions. Then check the mailbox for new forwarding rules and review recent sign-ins for unfamiliar activity. Speed matters, because attackers often use a compromised mailbox within minutes. Firms with monitoring get an alert before anyone has to report anything.
How does security monitoring work for a small law firm?
Software watches Office 365, email, and devices for unusual behavior, such as sign-ins from odd locations, new forwarding rules, or a mailbox suddenly sending files. When something looks wrong, a person is alerted and responds. For a small firm, that replaces hoping someone notices a problem before the damage spreads.
What do cyber insurers ask law firms about security?
Insurers commonly ask about multifactor authentication, backups, endpoint protection, patching, employee training, and incident response plans, often in a long questionnaire. Your answers become commitments, so they need to be true. We help law firms complete these and make sure the controls described are actually in place.
| Control | What it does | What it does not do alone |
|---|---|---|
| Multifactor authentication | Stops logins that rely on a password alone | Does not stop malware already on a device |
| Email and phishing protection | Filters dangerous messages before staff see them | Cannot catch every targeted message |
| Monitoring of Office 365 and email | A person is alerted to unusual activity and responds | Needs the layers above feeding it |
| Tested backups | Restores files after ransomware or deletion | Does not stop the attack or data theft |
| Staff training | Helps attorneys and staff spot a bad file or link | Does not replace technical controls |
How we caught a phishing attack at a law firm before it did damage
Hansen & Cleary is a law firm client we put on Todyl, a security platform that watches Office 365 and email much more intelligently than standard tools. One day it flagged that a suspicious link had been clicked and that strange activity had started on the administrative assistant’s email account. We got an instant alert and a call.
We reached out to the firm right away. She told us a lawyer had sent her a file that kept asking for her password and would not open. She had forwarded it to another lawyer, who ran into the same thing.
Because we saw it as it happened, we did not have to wait for the firm to discover a hack. We reset her password, told the firm what was going on, and stopped the attacker before they could do any damage.
Joe Engelking, CEO
Security built around what law firms actually risk.
Privilege-aware data protection
Client files, case data, and privileged communications protected with access controls built for confidentiality, not just uptime.
24/7 threat monitoring
Real-time monitoring and a SOC team watching for the ransomware and phishing attacks that specifically target law firms.
Bar compliance support
Security practices and documentation that hold up to bar association and malpractice-insurance scrutiny.
Coverage built for law firms.
- Threat detection & response
- Security & compliance audits
- Endpoint protection
- Managed detection & response (MDR)
- Security information & event management (SIEM)
- Identity & access management
A breach is an ethics problem, not just an IT problem.
Client confidentiality isn't optional for a law firm — it's a bar obligation. We build cybersecurity with that reality in mind, not as a generic add-on. Pair this with our <a href="https://lmeservices.com/law-firm-it-services/">Law Firm IT services</a> for full day-to-day support alongside security.
Real businesses, real relationships.
“They deliver on a wide breadth of IT services and ensure everything works correctly. With the personal touch of a small team, LME communicates efficiently and is instantly responsive by email or phone.”
“When Joe assigned Ivan as our lead, we felt like we finally had IT solved. Ivan has been with us 24×7 and the team behind him makes sure nothing falls through the cracks.”
Common questions
Law firms hold privileged client data — a breach isn't just downtime, it can trigger bar complaints, malpractice exposure, and loss of client trust.
Yes — we help document and implement security practices that hold up to that kind of scrutiny.
Yes — law firms are frequent targets specifically because of the sensitive data they hold and the pressure to protect client confidentiality.
Yes — see our Law Firm IT services page for day-to-day support alongside this security coverage.