Why Your Biggest Cyber Security Risk Is a Departing Employee

As an Ontario lawyer, you’re going to be worried about cyber security threats. But you may not have your eye on all the possible dangers, which can threaten not only your firm but also your clients and even suppliers and vendors.

When most of us think about cyber security threats, we envision an outside attacker like you’d see in Blackhat or Anon: masked, shadowy figures in dark rooms lit up by the latest tech. They do exist, and the damage they’ve done is extensive. But the threat that tends to be underestimated, and that can be harder to contain, is the one that walks out your front door.

Staff turnover at law firms is part of practice life. Associates leave for other firms or in-house roles. Assistants move on. Clerks finish contracts. Partners occasionally part ways under circumstances that are less than cordial. Each departure is also, whether you treat it that way or not, a security event. And at most small firms, it isn’t being handled like one.

The Access Problem Nobody Is Tracking

When someone joins your firm, they accumulate access over time. They get an email account, login credentials for your practice management software, access to shared drives, a spot in your document management system, maybe permissions in your billing platform. If they work with clients, they may have been added to folders or client portals.

When they leave, how much of that access gets revoked? At larger Ontario law firms with dedicated IT departments, there’s a checklist that covers everything. At smaller firms, the answer is: some of it, eventually – when someone remembers.

The problem is the gap between the last day and the day someone gets around to it. A former employee with credentials can still log in to your systems. They can still read emails forwarded to a shared account. They can still access documents they were working on. In most cases they won’t. But “probably won’t” is not a standard that holds up when client confidentiality is at stake.

It Isn’t Always Malicious, and That’s the Danger

It’s tempting to frame this issue as a question of bad actors: the associate who takes a client list, the departing partner who downloads files before their last day. That does happen. But the more common version of this problem isn’t intentional at all.

A lawyer leaves your firm and joins another. They don’t think of themselves as ‘taking anything.’ But their laptop still has a cached copy of documents they worked on. Their phone still has your firm’s email account configured on it. They saved files to their cloud storage because it was easier to work from home that way. None of it was done with any intent to cause harm. But all of it is now sitting outside your control.

This is the version of the problem most firms are unprepared for. There’s no villain to blame and no moment when the breach occurred. There’s information about your clients residing somewhere you didn’t authorize, with someone who no longer works for you.

The Shadow IT Problem

At many small Ontario firms, lawyers and staff have adopted their own tools over the years. Common examples include:

• A file transfer service to send large documents to clients
• A note-taking app that syncs to cloud storage
• A client’s preferred messaging platform

None of these resources were approved. None of them are on any vendor list. And when the person who was using them leaves, nobody knows to shut down those accounts or retrieve that data.

Shadow IT has grown alongside the proliferation of free cloud tools. The result is that client information is stored in places the firm has never acknowledged, under credentials that belong to individuals rather than the firm.

The Departure You Weren’t Expecting

Everything above assumes you have some notice. The harder scenario is the departure you didn’t see coming: a termination, a resignation effective immediately, a relationship that ends badly. These are the situations where the temptation to handle things quickly and move on is strongest. They’re also the situations where a security review is most important.

The lawyers who get this right aren’t the ones who assume the best about departing staff. They’re the ones who have an onboarding practice they use regardless of how a departure unfolds.

What This Means for Your Obligations

The duty of confidentiality doesn’t have an exemption for oversights. If a former employee has access to client files, or if client documents are sitting in a Dropbox account because a lawyer found it convenient, you’ve got a confidentiality problem. The fact that it happened without intent doesn’t change what it is. The Law Society of Ontario expects lawyers to take reasonable steps to protect client information. “We didn’t have an offboarding checklist” is not a reasonable step.

What to Do About It

None of this requires a major technology investment. All you need is a set of practices applied every time someone leaves the firm.

• Treat every departure as a security event from the moment it’s known. Whether the departure is amicable or not, the moment you know someone is leaving is the moment to start the access review. Don’t wait until after their last day.
• Build an access inventory before you need it. You can’t revoke access to systems you’ve forgotten exist. Maintaining a list of what accounts and permissions each staff member holds makes offboarding faster and less likely to miss something.
• Address devices. If firm email or documents have ever been accessed on a device you don’t own, that needs to be part of the departure conversation. It may be awkward. It’s less awkward than a confidentiality complaint.
• Ask about shadow IT. When someone is leaving, ask them: are there any tools or platforms you’ve been using for work that aren’t part of our setup? Most people will answer when asked, and the conversation itself signals that this is something the firm takes seriously.
• Change shared passwords on the day someone leaves. Not when you get around to it.

The Bottom Line on Departing Staff and Client Data

Most law firms across Ontario put a lot of thought into who they hire and how they onboard them. Few put the same amount of consideration into what happens when that person leaves.

Cyber security conversations at law firms tend to focus on external threats. But the access you’ve granted your own staff, and the question of whether that access ends cleanly when they depart, is one of the few risks you have direct control over. You don’t control whether a vendor gets breached or opposing counsel has good security practices. You do control who has credentials to your systems and when those credentials stop working.

That’s not a technology problem. It’s a management decision. And unlike most security issues, it doesn’t require a budget, a consultant, or a new software subscription to address. It requires a clear practice, applied consistently, starting with the next departure.