Law firms

An email in your firm's name can be forged. Clients wire money on it.

Retainer requests, trust-account transfers and closing-day wires all travel by email. Attackers read your domain. We read it first and show you what is open.

Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. Each finding we hand you is human-verified before your assessment is released.

Check my firm How we read a domain
Outside reads onlyNot a pen testHuman-verified72 hours to your documents
Rules that apply to youMapped per finding
ABA Model Rule 1.6
Duty of confidentiality; your state bar adopts its own version
ABA Formal Opinion 477R
Reasonable efforts to secure client information sent online
ABA Formal Opinion 512
Understanding the risks of AI tools
FTC Act Section 5
Unfair or deceptive security practices
State breach notification laws
Notice to affected residents
Also in Canada
Law society rules of professional conduct, PIPEDA Principle 4.7, PIPEDA s. 10.1 and 10.3
Each finding mapped to the rule it touches in the Rules and Insurance Briefing, so you can show your regulator what you checked and fixed.
When you must report

The reporting deadlines that apply to you.

US, every state
Varies by state
State breach notification laws

Notify affected residents when certain personal information is breached. Timing and content differ.

Canada, federal
As soon as feasible
PIPEDA

Report a breach that creates a real risk of significant harm to the Privacy Commissioner, and tell the people affected.

Quebec
Promptly
Quebec Law 25

Notify the Commission d'accès à l'information and the people concerned of an incident that risks serious injury, and keep a register of every confidentiality incident.

Your deadline
Varies by state
State breach notification laws

A summary of published rules, not legal advice. The Rules and Insurance Briefing names the rules that apply to you.

With your clients

Clients trust you with what they tell no one else. A forged email in your name is the call they make to their next lawyer.

01 · This week, across all firms

Nothing reported for this sector this week. What attackers used elsewhere, and what we check for it.

15 Oct 2026 · The Record
BAE Systems

A cyberattack on defense contractor BAE Systems disrupted the U.S. Bankruptcy Noticing Center platform used by all federal bankruptcy courts. The incident took several …

14 Oct 2026 · Security Affairs
A Volexity customer
Way in
A known flaw in software the victim ran.
We check
Software versions your site advertises and known flaws in them.
Recent cases in your line of work

Payment fraud, from the public record.

27 May 2025

A California appeal court decision published in May 2025 covers a $475,000 settlement payment that went to criminals. They wrote to the paying side's lawyer from a domain one letter different from the other law firm's. The court ordered the paying side to pay again.

2 Sep 2026 · United Kingdom

On 2 September 2026 the Solicitors Regulation Authority in England warned that emails misusing the name of Penningtons Manches Cooper LLP gave a client payment instructions for an invoice. They came from a domain that swapped a "q" for the "g" in the firm's own.

25 Jun 2026 · Canada

In June 2026 the Nova Scotia lawyers' insurer reported that a lawyer paid over $700,000 of a client's sale proceeds into a fraudster's account. The new banking instructions came from an email address that misspelled the client's own. The money came back to the trust account about a month later.

Each case is from the public source linked under it, in that source's own terms. LeakTrace had no part in any of them.

All published cases against law firms

Your outside changes

What changes after your assessment, and how often we look.

  • 01A new vendor or tool is allowed to send as you.
  • 02Your mail moves to a new provider.
  • 03A new portal or subdomain goes live.
  • 04A certificate lapses.
  • 05Your addresses turn up in a fresh breach.
  • 06A look-alike of your name is registered.

On monitoring: email settings, look-alikes and new host names hourly; everything else daily, with newly exploited flaws matched to your website’s software within a day and an alert the same day. The first month of monitoring comes with the assessment.

02 · Featured research
Law firms · 4 min · Sep 2026

Seven in ten law and accounting firms have no published rule telling mail servers to refuse mail forged in their name

What the public records of law and accounting firms say about forged email, read from outside.

Read the research
03 · What you receive

Human-verified. The full watch, the proof for every finding, and the fix.

1
Owner Summary and Action Brief
For the owner
2
Technical Evidence and Findings
Each finding, with its fix
3
Rules and Insurance Briefing
Privacy rules and insurer questions
4
Assessment Record
Dated record, issued by LeakTrace Inc.

What the fourth document is. A dated record of what was read from outside your firm, verified by a person at LeakTrace before release. LeakTrace Inc. issues it as a company, with a reference and a fingerprint anyone can check at getleaktrace.com/verify/. No individual signs it. It is not a certification, not a penetration test, not legal or compliance advice, and not a statement about your internal systems.

A recorded walkthroughA short video of your own dashboard, made at release.
The first month of monitoringYour domain and its addresses watched: email settings, look-alikes and new host names re-checked every hour, with an alert within the hour to a named contact; the rest daily.

We close it: We give you the fix for each finding and re-check from outside until it is closed.

The one change we can make ourselves is to your email records, and only when you approve each step, where your DNS host allows it.

Where it does not, you get the exact records to paste.

Your evidence pack:

  • an owner summary
  • the technical evidence with the fix for each finding
  • a rules and insurance briefing
  • a dated assessment record

It doubles as your insurance renewal evidence pack:

  • the outside questions insurers commonly ask at renewal, each shown with its evidence
  • forged-email protection where we reach your DNS host, one click per step
  • the Rules and Insurance Briefing, which sets each of your findings beside the plain terms a renewal application uses

Settlement and trust-account wire instructions are what a forged email or a look-alike domain is used to change.

On monitoring, fixed checks re-check the sender records and look-alike domains that make that possible, every hour, and the Monitor AI agent puts first the change that needs you.

The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own firm's findings.

Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.

The one change they can make, to your email records, happens only when you approve it.

What each AI agent does, and what it can never do.

04 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone

See a sample reading → An invented firm, so you see what arrives before you ask for yours.

Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy