Cyber Insurance for Law Firms and CPA Firms in Washington

Law and accounting firms hold client financial, tax, and legal records and move client money, which makes them prime targets for breaches and wire fraud. Washington lawyers must make reasonable efforts to protect client information under RPC 1.6(c); tax preparers fall under the FTC Safeguards Rule, which requires a written security plan and FTC notice of breaches affecting 500 or more people. Cyber coverage should be coordinated with professional liability.

By Trella Commercial · Updated October 4, 2026

The short version

The data is valuable and the money moves. Tax returns, Social Security numbers, bank details, and settlement or trust funds make these firms targets for both breaches and payment fraud.
Professional rules raise the bar. Washington's RPC 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized access to client information. The FTC Safeguards Rule treats tax preparers as financial institutions, with required security controls.
There are extra notice duties. Tax preparers must notify the FTC within 30 days of a breach involving 500 or more consumers. ABA Formal Opinion 483 says lawyers have a duty to notify clients of breaches involving material client information.
The Washington data shows it. Legal practices filed 35 and professional services firms 57 breach notices with the Attorney General.
Coordinate cyber with professional liability, so a client's wire fraud loss or a breach of client files is not caught between the two.

The rules that shape a firm's cyber exposure

Law firms

Rule	What it says	Cyber relevance
Washington RPC 1.6(c)	A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client	Security controls are an ethics issue, not just an IT issue
Washington RPC 1.15A	Lawyers must hold client and third-party property, including funds, separate from their own	Trust accounts are a target for fraudulent disbursement requests
ABA Formal Opinion 483 (2018)	Lawyers have a duty to monitor for breaches, act to stop them, and notify current clients when material client information is involved	Breach response includes client communication, alongside state notice laws
ABA Formal Opinion 477R (2017)	Lawyers may communicate over the internet if they make reasonable efforts to prevent unauthorized access, with more care for sensitive matters	Encryption and secure portals for sensitive documents
WSBA Advisory Opinion 2215	Lawyers may use online storage if they take reasonable care that client information remains confidential and secure	Vendor and cloud choices need due diligence
Washington APR 26	Lawyers certify annually whether they carry professional liability insurance, and the information is public	Washington does not require malpractice insurance, but disclosure is public

CPA firms and tax preparers

Rule	What it says	Cyber relevance
FTC Safeguards Rule (16 CFR 314)	A business completing income tax returns is a financial institution under the rule	Applies regardless of firm size
Required controls	A written information security program, a qualified individual in charge, multifactor authentication for anyone accessing information systems, and encryption of customer information in transit and at rest	The same controls cyber insurers ask about
Breach notice to the FTC	For a notification event involving at least 500 consumers, notify the FTC as soon as possible and no later than 30 days after discovery (effective May 13, 2024)	An additional deadline beside state breach laws
IRS Publications 4557 and 5708	Tax preparers must create security plans; Publication 5708 provides a written information security plan (WISP) template	A WISP is evidence of reasonable security for regulators and insurers
IRS data theft reporting	Report client data theft to your local IRS Stakeholder Liaison	Helps stop fraudulent returns filed with stolen data
WAC 4-30-050	A Washington licensee in public practice shall not disclose confidential client information without the client's specific consent	Confidentiality duties sit alongside breach laws

The losses firms actually face

Scenario	Who loses	Coverage that usually responds
Ransomware locks files during tax season or before a filing deadline	The firm, through downtime and missed deadlines	Cyber extortion, data restoration, business interruption
A hacker accesses client tax returns or case files	Clients whose data was exposed; the firm through response costs	Cyber breach response and privacy liability
An employee wires trust or escrow funds after a fake instruction	The firm, and potentially clients	Social engineering coverage under cyber or crime
A client wires money to a criminal after instructions from the firm's hacked email	The client, who may claim the firm was negligent	Possibly professional liability or cyber liability, depending on wording
Fraudulent tax returns are filed using stolen client data	Clients, with IRS and state remediation	Cyber breach response; IRS reporting
A regulator or the FTC investigates the firm's security	The firm	Cyber regulatory defense

Where cyber and professional liability meet

Professional liability (lawyers' or accountants' malpractice coverage) covers mistakes in your professional services. Cyber covers breaches, ransomware, and privacy claims. The gray areas:

A client loses money because of your hacked email. The client may sue for negligence. Some professional liability policies respond; others exclude claims arising from security failures, pushing it to cyber liability, which may or may not cover the client's financial loss.
A breach exposes client files. Usually a cyber claim, but the client's complaint may also allege a professional breach of confidentiality.
Missed deadlines caused by ransomware. A malpractice claim for the missed deadline, triggered by a cyber event.

Ask your broker to read both policies together and confirm which responds to each scenario. See cyber vs tech E&O vs crime and the CPA firm story.

Coverage features to insist on

Feature	Why it matters for law and CPA firms
Social engineering with a meaningful sublimit	Trust, escrow, and client payments are large; small sublimits do not match the exposure
Coverage for client funds you hold	Some fraud coverage applies only to the firm's own money
Regulatory defense, including FTC and bar inquiries	Safeguards Rule and ethics investigations follow breaches
Business interruption with a short waiting period	Tax season and court deadlines make every day offline expensive
Breach response sized for your client records	Firms hold complete identity profiles; notification and monitoring scale with clients
Coordination with professional liability	Prevents both policies from pointing at the other

Controls that satisfy both regulators and insurers

Multifactor authentication on email, practice management, tax software, document portals, and banking. The Safeguards Rule requires it for tax preparers.
A written information security plan. Required for tax preparers; strong evidence of reasonable efforts for lawyers.
Encryption of client data in transit and at rest, including laptops and email of sensitive documents.
Secure client portals instead of email attachments for returns and case files.
Call-back verification for every change in wiring instructions, for both outgoing payments and instructions you give clients.
Tested backups, separated from the network, especially before tax season.
Vendor due diligence for cloud practice management and storage.

Common questions

Do law firms need cyber insurance?

Most do. Law firms hold confidential client information, often handle trust or settlement funds, and have ethical duties to protect client data under Washington RPC 1.6(c). A breach can require notice to clients and under state law, and malpractice policies typically do not cover breach response or ransomware.

Are CPA firms required to have cyber insurance?

No law requires cyber insurance. But the FTC Safeguards Rule requires tax preparers to maintain a written security program with controls such as multifactor authentication and encryption, and to notify the FTC within 30 days of a breach involving 500 or more consumers. Cyber insurance pays for responding to those obligations.

What is a WISP for tax preparers?

A written information security plan describing how a tax practice protects client data. The FTC Safeguards Rule requires one, and IRS Publication 5708 provides a template for tax and accounting firms.

Does malpractice insurance cover a data breach?

Usually not fully. Lawyers' and accountants' professional liability covers mistakes in professional services. Breach response, ransomware, and regulatory investigations are generally cyber coverages. Some malpractice policies include a small cyber endorsement, but it is typically limited.

What should a firm do if client tax data is stolen?

Call your cyber insurer's breach hotline, report the theft to your local IRS Stakeholder Liaison, and follow state breach notice laws. If the information of 500 or more consumers is involved, notify the FTC within 30 days. See the first 24 hours after a breach.

Sources

This page is general information, not legal or ethics advice. Confirm your obligations with your bar, the Board of Accountancy, or counsel. Reviewed October 2026.

More in this guide

Cyber Insurance for Washington and Idaho Small Businesses: The Complete Guide
The complete guide this page is part of.
Washington Data Breach Notification Law: What a Small Business Must Do
Washington's breach law, RCW 19.255, explained for small businesses: what counts as personal information, the 30-day deadline, Attorney General notice, what the notice must say, vendors, encryption, and penalties.
Washington's My Health My Data Act: The Privacy Risk Most Businesses Miss
Washington's My Health My Data Act (RCW 19.373) reaches gyms, wellness studios, salons, apps, and retailers, not just health care. Who it covers, what it requires, the 2,000-foot geofence ban, and how cyber insurance fits.
What Does Cyber Insurance Cover? First-Party and Third-Party Coverage, Explained
Every part of a cyber insurance policy explained: breach response, ransomware, business interruption, data restoration, wire fraud, liability, regulatory, PCI, and media coverage, plus how limits, sublimits, and waiting periods work.
What Cyber Insurance Does Not Cover (and the Exclusions That Matter)
The cyber insurance exclusions and conditions that cause denied claims: prior knowledge, failing to maintain security controls, war and infrastructure exclusions, wrongful collection, betterment, contractual liability, and the gaps between cyber and crime.
Does My BOP or General Liability Policy Cover a Data Breach?
Why most business owners policies and general liability policies do not cover data breaches, ransomware, or wire fraud: the 2014 data breach exclusions, the electronic data exclusion, the small cyber endorsements some BOPs add, and how to check your own policy.
Cyber Insurance vs Tech E&O vs Crime Insurance: Which Do You Need?
How cyber insurance, technology errors and omissions, professional liability, and crime insurance differ, where they overlap, where wire fraud and employee theft land, and which combination fits your type of business.
Do Small Businesses Need Cyber Insurance?
A practical way to decide whether your small business needs cyber insurance: the questions that matter, what Washington breach data shows about businesses like yours, and when a small policy or no policy is reasonable.
How Much Cyber Insurance Does a Small Business Need?
A step-by-step way to choose a cyber insurance limit for a small business: count your records, estimate downtime, find your largest payment exposure, check contracts, and set sublimits and a retention that fit. With Washington breach-size data.
What Drives the Cost of Cyber Insurance (and How to Lower It)
Why cyber insurance quotes vary so much between businesses: the rating factors insurers use, the security controls that move price and eligibility most, and practical ways to lower your premium without losing the coverage that matters.
What a Cyber Insurance Application Asks: MFA, Backups, Training, and More
The questions on a small business cyber insurance application, section by section: company details, data, multifactor authentication, backups, endpoint protection, patching, training, payment controls, and prior incidents, with a checklist to prepare.
A Client Contract Requires Cyber Insurance: What the Clause Means and What to Buy
How to read the cyber insurance requirement in a client, vendor, or lease contract: limits, coverage parts, additional insured, primary and noncontributory, notice, claims-made terms, certificates, and the red-flag clauses to negotiate.
Does Cyber Insurance Cover Wire Fraud and Fake Invoices?
How cyber and crime policies treat wire fraud, fake vendor invoices, CEO impersonation, and customers paying criminals: social engineering, funds transfer fraud, and invoice manipulation coverage, sublimits, verification conditions, and what to do in the first hour.
Ransomware and Cyber Insurance: What It Pays For, Including the Ransom
What a cyber policy pays after a ransomware attack: negotiation, the ransom where lawful, forensics, restoration, lost income, breach notification, and lawsuits. Plus the sanctions rules on paying, what insurers require, and the first steps to take.
Cyber Business Interruption: When Your Systems, or Your Vendor's, Go Down
How cyber business interruption coverage works: what it pays, waiting periods, the period of restoration, dependent business interruption for cloud and software vendors, system failure, how the loss is calculated, and lessons from the Change Healthcare and CrowdStrike outages.
What to Do in the First 24 Hours After a Data Breach in Washington
A practical first-24-hours checklist for a small business after a data breach or ransomware attack in Washington: who to call, what to preserve, what not to do, how the 30-day notice clock works, and how your cyber insurance fits in.
Cyber Insurance for Dental and Medical Practices in Washington
Cyber insurance for Washington dental offices, medical clinics, therapists, and other health practices: HIPAA breach rules alongside Washington law, the My Health My Data Act, vendor outages like Change Healthcare, and the coverage features that matter most.
Wire Fraud in Washington Real Estate Closings: Escrow, Agents, and Cyber Coverage
How closing wire fraud works in Washington real estate, who is exposed (escrow agents, brokerages, lenders, attorneys, buyers, sellers), what Washington regulators tell escrow agents, the coverage each party needs, and what to do in the first hour.

Find out what your current policies actually cover.

Send us what you have. We review it line by line against your leases and contracts, and tell you plainly what is missing. Free, and no obligation.

Get a free policy review Call (425) 537-7773