Yes. ABA Model Rule 1.6 requires attorneys to make reasonable efforts to prevent unauthorized disclosure of client information. Most state bar associations have adopted similar rules. A cybersecurity breach that exposes client data can result in disciplinary action, malpractice liability, and reputational damage.
