BREAKING NEWS! Protecting Your Law Practice: FBI Chief Cautions Congress Against Impending Chinese Cyberattacks.

FBI Director Christopher Wray TESTIFYING before the House China Committee.

On January 31, 2024, FBI Director Christopher Wray testified before the House China Committee. He warned about an ongoing Chinese hacking threat against the United States' crucial infrastructure, including water treatment, energy, transportation, and communications. In an era where cyber threats are becoming increasingly sophisticated and pervasive, the legal profession has become a prime target for malicious actors seeking to gain unauthorized access to sensitive information. Lawyers should take note as the Federal Bureau of Investigation (FBI) has been sounding the alarm on the growing concern of Chinese cyberattacks specifically targeting law firms.

The motives behind these cyberattacks are multi-fold. China's government-backed hackers often seek strategic advantages by acquiring insights into pending litigation or business deals involving American companies. By gaining access to confidential attorney-client communications or negotiating strategies, they can undermine negotiations or influence outcomes in favor of Chinese entities. Furthermore, the stolen intellectual property can be leveraged by Chinese corporations to be used as a blueprint for developing competitive products without incurring research and development costs. This unfair advantage undermines American businesses' ability to compete fairly in global markets and jeopardizes industries vital for national economic growth.

You might believe that your firm is safe from hacking by foreign governments because of its size or the specific legal field you specialize in. However, if any of your clients are targets of interest to hackers, your firm's data could also be at risk.

In order to safeguard your practice and client data, it is essential to adhere to key recommendations provided by the FBI:

Government sponsored cyber attacks can target even the smallest law firm!

• Enhance Cybersecurity Infrastructure: Strengthening your practice's cybersecurity infrastructure should be a top priority. Implement multi-factor authentication for all devices and systems accessing sensitive information. Regularly update software programs, operating systems, and antivirus solutions to ensure they are equipped with the latest security patches. Additionally, consider employing a robust firewall and intrusion detection system to monitor network traffic and identify potential threats.

• Conduct Regular Security Assessments: Perform periodic security assessments of your practice's IT infrastructure to identify vulnerabilities or weaknesses that could be exploited by cybercriminals. Engage reputable cybersecurity firms or consultants who specialize in conducting comprehensive assessments of networks, applications, and databases. These assessments will help you identify potential entry points for hackers and develop strategies to mitigate risks effectively.

• Invest in Employee Training: The human element remains one of the weakest links in any organization's cybersecurity defense system. Train your staff on best practices for identifying phishing attempts, recognizing suspicious emails or attachments, using strong passwords, and practicing safe browsing habits online. By raising awareness among employees about potential cyber threats and providing them with the necessary knowledge to respond appropriately, you can significantly reduce the risk of successful attacks.

EMployee training can be one of your first lines of defense against cyber attacks!

• Implement Data Encryption Measures: Encrypting sensitive data is an effective way to protect it from unauthorized access during transmission or storage. Utilize encryption tools across all communication channels within your practice – including email correspondence – as well as when storing files on local or cloud-based servers. Encryption ensures that even if cybercriminals gain access to your data, it remains unreadable and unusable to them.

• Regularly Back Up Data: Implement a robust data backup strategy to ensure you can recover critical information in the event of a cyberattack or system failure. Regularly back up all client files, case documents, and other important data to an off-site location or cloud-based service. Test the restoration process periodically to verify the integrity of your backups and guarantee their availability when needed.

• Establish an Incident Response Plan: Prepare for potential cyber incidents by developing a comprehensive incident response plan. This plan should outline the steps your practice will take in the event of a breach, including who should be notified, which authorities should be contacted, and how affected clients should be informed. By having a well-defined response plan in place, you can minimize damage and ensure timely action during high-stress situations.

The warning issued by FBI Director Christopher Wray underscores the urgency for legal practitioners to fortify their practices against these malicious actors. By prioritizing cybersecurity measures, fostering a culture of awareness, and collaborating with law enforcement agencies like the FBI, lawyers can better protect themselves and their client's interests and uphold the integrity of the legal profession in an increasingly digital world.

A Humorous BOLO: Windows update renames ALL printers "HP LaserJet"!

What a world we live in when our computers cannot recognize the printers they are connected to!

According to PCWorld, a recent Windows update has left users bewildered as every printer, regardless of brand, transformed into an "HP LaserJet M101-M106". Whether you have an old Canon or the latest Epson, they all proudly bare the HP LaserJet label. This quirky bug, while not causing major technical issues, certainly led to some head-scratching and chuckles. 🤪

It's a reminder that in the digital world, even printers can have an identity crisis!

BOLO: LastPass Password Vault Users Need to Check Their Accounts!

LastPass has been hacked twice in six months!

Tim Hardwick of  macrumors.com reports that popular password manager LastPass has been hacked for a second time within the last six months!  LastPass CEO, Karim Toubba, provided in a statement:

We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. 

what information of yours was obtained by lastpass hackers?

Toubba provides that users' passwords are safe and that they are working on the issue.  It appears though that some user information was compromised.  I would check on your credit card information and maybe check your credit report to make sure no unauthorized charges, credit card applications or loan applications were made!

You may want to consider find a new password minder?

BOLO: Watch Out for Electronic Payment Scams!

What Out for Electronic Payment Scams!

Daniel Oropeza at Lifehacker reports that there has been a rise in people being scammed with the Zelle payment app.  There are a lot of other similar payment apps, and they all provide an easy way to send money to others without having to write a check or have cash on hand.  This can serve as a possible easier means of doing business:  These apps may take out certain steps, e.g., writing and mailing a check, when paying your contract workers and easier way to keep track of payments for 1099-R IRS reporting.  Plus the recipient can get their money almost instantaneously!  The problem with these apps is when you get unsolicited calls, e-mails, or texts to "authorize" or "confirm a payment" you did not make or were expecting.  You get a text like this:

FreeMsg: BANK OF AMERICA Fraud Protection Team: Did you attempt a Zelle Transfer for $550.00 on 10-10-2022? Reply YES or NO. To Opt Out Fraud Alert Text reply STOP

 This seems like a fairly innocuous message.  But replying to it gives the scammers enough information to empty your bank account.  Never a good thing.  Remember, Zelle is by its own definition “… is a great way to send money to friends and family, even if they bank somewhere different than you do.” (emphasis added).  So when you get one of these messages, you should have an idea if you have been sending or receiving money to/from someone.  You should never give out personal/business information from unsolicited communications.

 Here are some tips to avoid being scammed through a payment app:

You are your best protection against electronic cammers.

• If you get an unsolicited text message from your bank or credit card, make sure it’s from a valid number for your bank.  If not, mark it as spam and delete it.  I use Noborobo to help block spam texts on my iPhone.  The company will be expanding spam text coverage to Android phones soon!

• If you get an unsolicited e-mail from your bank or credit card, check the senders e-mail address carefully.  It’s likely a spoof of your bank or even unrelated to your bank.  Mark it as spam.  You can either put it in your junk file or just delete it.  I use Sanebox to deal with spam e-mail.  It’s a paid third-party service that uses artificial intelligence to help identify your important e-mails, put off less important e-mails for review at a later date, and trashes junk, spam, etc. into a "blackhole." **Personal note:  I have been using it for years and it saves me a lot of time with my e-mail.

• If you get an unsolicited calls for your bank or credit card requesting personal information, don’t give it! Don’t answer numbers you don’t recognize, mark as spam unsolicited callers who ask for it.  I use Noborobo to help block spam calls on my iPhone and Samsung (Android).

The theme is don’t give away your personal information to unsolicited communications!  If you have concerns about your credit card or bank account, call your credit card or bank directly on a confirmed phone number.