Imagine a senior partner at a mid-sized law firm arriving at the office on a Monday morning only to find their entire case management system locked behind a ransomware screen. Client files, privileged communications, litigation strategies — all encrypted. The attacker demands $500,000 in cryptocurrency. The firm has 72 hours to pay.
This is not a hypothetical. It happened to a real law firm, and it has happened to hundreds more. In 2023 alone, law firms reported a sharp uptick in targeted cyberattacks, with ransomware, data breaches, and business email compromise topping the list. Attorneys are sitting on some of the most sensitive data in existence — merger negotiations, criminal defense strategies, trade secrets, estate plans, and medical records — and cybercriminals know it.
The painful truth is that many law firms, particularly small and mid-sized practices, still treat cybersecurity as an IT expense rather than a professional obligation. But that framing is dangerously wrong. In today’s threat landscape, cybersecurity for law firms is a matter of ethics, legal liability, and client survival.
This guide walks you through everything your firm needs to know: the threat landscape targeting legal professionals, your ethical and regulatory obligations, the technologies and frameworks that protect privileged data, and the policies that turn security from a checklist into a culture.
Why Law Firms Are Prime Cyberattack Targets
Law firms do not just hold data — they hold the most valuable, time-sensitive, and legally protected data in any industry. That makes them uniquely attractive targets.
The Value of Legal Data to Cybercriminals
A healthcare record might sell for $10 on the dark web. A law firm file containing an unannounced corporate merger can be worth millions to a sophisticated threat actor looking to engage in insider trading. Hostile foreign governments target law firms representing defense contractors or government agencies. Ransomware groups specifically hunt legal practices because the reputational and legal pressure to recover data quickly is enormous — making firms more likely to pay.
The American Bar Association’s 2023 Legal Technology Survey Report found that 29% of respondents said their firm had experienced a security breach at some point. Among firms with 100 or more attorneys, that number climbs even higher.
The Attorney-Client Privilege Problem
The attorney-client privilege is one of the oldest and most sacred principles in the law. It protects the confidentiality of communications between attorneys and their clients, enabling frank disclosure and an effective legal defense. A data breach does not automatically waive privilege in every jurisdiction, but it creates complex, expensive, and deeply damaging legal questions.
If a firm’s email system is compromised and a criminal downloads client communications, opposing counsel may move to introduce those communications as evidence, arguing that privilege was not adequately protected. Courts have handled these disputes inconsistently, and the outcome often depends on whether the firm took reasonable precautions to protect the data — a standard increasingly defined by cybersecurity best practices. In short, weak cybersecurity can destroy the very privilege your clients pay you to protect.
Common Threat Vectors Targeting Legal Professionals
Attackers do not break into law firms the way Hollywood depicts. They do not need to. The most common entry points are the humans inside the firm.
Phishing emails remain the number one initial access vector across all industries, and law firms are no exception. A well-crafted spear-phishing email impersonating a court clerk, a title company, or a client can trick even experienced attorneys into clicking a malicious link. Once inside, attackers move laterally across the network, escalating privileges and exfiltrating data for weeks before anyone notices.
Business email compromise (BEC) is particularly devastating for firms handling real estate transactions or wire transfers. An attacker who compromises a paralegal’s email account can intercept a transaction at the last moment and redirect six-figure wire transfers to a fraudulent account. These funds are rarely recovered.
Ransomware, supply chain attacks targeting legal software vendors, and insider threats from disgruntled employees round out the primary threat categories.
Read more: Cybersecurity Policy
Ethical and Regulatory Obligations for Law Firm Cybersecurity
Cybersecurity for law firms is not optional — a web of ethical rules, bar regulations, and data protection laws mandate it.
ABA Model Rules and the Duty of Competence
The American Bar Association’s Model Rule 1.1 requires that attorneys provide competent representation, including the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation. In 2012, the ABA amended the Comments to Rule 1.1 to explicitly include understanding “the benefits and risks associated with relevant technology.” This is widely understood to include cybersecurity technology.
Rule 1.6 requires attorneys to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. State bar associations across the country have issued formal opinions reinforcing that this duty extends to digital systems — cloud storage, email, mobile devices, and third-party vendors. Violating these duties can result in bar discipline, malpractice liability, and loss of client trust.
State Data Breach Notification Laws
All 50 U.S. states now have data breach notification laws. When a law firm suffers a breach that exposes personally identifiable information (PII) — names, Social Security numbers, financial account information, health data — it triggers notification obligations to affected individuals, and in many states, to the state attorney general.
The timelines are aggressive. Some states require notification within 30 days of discovering a breach. Others impose penalties of up to $5,000 per affected individual for failures to notify. Firms that fail to report can face regulatory enforcement actions in addition to client lawsuits.
HIPAA Compliance for Law Firms Handling Health Data
Law firms representing healthcare clients, handling medical malpractice cases, or acting as business associates of covered entities under HIPAA are subject to the Health Insurance Portability and Accountability Act’s Privacy and Security Rules. This means implementing administrative, physical, and technical safeguards for protected health information (PHI) — requirements that go well beyond standard law firm security practices.
HIPAA violations carry civil penalties ranging from $100 to $50,000 per violation, with annual caps of $1.9 million per violation category. Criminal penalties can apply when violations involve intent to sell or misuse PHI.
GDPR and International Privacy Considerations
Law firms with clients or operations in the European Union must navigate the General Data Protection Regulation (GDPR). GDPR imposes strict requirements on how personal data is collected, stored, transferred, and deleted — and it grants data subjects (your clients) rights including access, correction, and erasure.
Non-compliance fines can reach €20 million or 4% of global annual revenue, whichever is higher. Even firms that do not consider themselves international may have GDPR obligations if they represent EU-based clients or if opposing parties in litigation are EU residents.
Read more: Cybersecurity Stack
Building a Law Firm Cybersecurity Framework
A cybersecurity framework gives your firm a structured approach to identifying risks, implementing controls, and responding to incidents. The NIST Cybersecurity Framework (CSF 2.0) and ISO/IEC 27001 are the two most widely adopted frameworks, and both translate well to the legal industry.
Conducting a Legal-Specific Risk Assessment
Every cybersecurity program begins with understanding what you are protecting and what threatens it. A legal-specific risk assessment maps your firm’s information assets — client files, email, billing records, matter management systems, financial accounts — and evaluates the threats and vulnerabilities relevant to each asset.
The risk assessment should identify your crown jewel assets: the data that would cause the greatest harm to clients and the firm if compromised. For most law firms, this includes privileged communications, litigation strategy documents, and any data subject to regulatory protection such as PHI or PII.
Your assessment should also account for third-party risk. Legal practice management platforms, e-discovery vendors, cloud storage providers, and even your building security systems can all serve as entry points for attackers. Every vendor with access to your data extends your attack surface.
The Five Core Functions of NIST CSF Applied to Law Firms
The NIST Cybersecurity Framework organizes security activities into five core functions: Identify, Protect, Detect, Respond, and Recover. Applied to a law firm context, these functions translate into practical priorities.
Under the Identify function, firms should catalog every device, system, and application that touches client data. Shadow IT — unsanctioned personal devices and cloud services used by attorneys and staff — is a pervasive problem in the legal industry. You cannot protect what you do not know exists.
The Protect function encompasses access controls, data encryption, staff training, and secure system configuration. This is where most day-to-day security work occurs and where firms have the greatest opportunity for improvement.
The Detect function requires the ability to notice when something goes wrong. Without active monitoring, most firms discover breaches months after the initial intrusion — when the attacker is long gone, and the damage is done.
The Respond function covers your incident response plan: the documented, rehearsed process for containing an attack, preserving evidence, notifying clients and regulators, and communicating with the public.
The Recover function ensures that your firm can restore operations after an incident. This means verified, tested backups — not just backups that exist somewhere on a drive, but backups that have been actually restored and confirmed to work.
Read more: GRC Cybersecurity
Essential Cybersecurity Controls for Law Firms
Understanding your obligations and your framework is only the beginning. The following controls form the operational backbone of a defensible law firm security posture.
Multi-Factor Authentication: The Minimum Baseline
Multi-factor authentication (MFA) is the single most impactful control you can implement. It requires users to verify their identity using two or more factors — typically something they know (a password) and something they have (an authenticator app or hardware token). MFA prevents the vast majority of credential-based attacks, including phishing and password spraying.
Every account that can access client data — email, document management, practice management software, VPN, cloud storage — must require MFA without exception. This includes personal devices used by attorneys to access firm resources. Attorney convenience is not a valid justification for bypassing MFA. The stakes are too high.
Hardware security keys (FIDO2 tokens) provide the strongest MFA protection and are resistant to sophisticated phishing attacks that can bypass app-based authenticators. For high-value accounts such as firm administration, managing partners, and financial systems, hardware keys should be considered the standard.
Zero Trust Network Architecture
The traditional security model assumed that everything inside the network perimeter was trusted. Zero trust architecture eliminates that assumption. Under zero trust, every user, device, and connection — regardless of network location — must continuously verify their identity and authorization before accessing any resource.
For law firms, zero trust translates into practical controls including network segmentation (so a compromised device in the reception area cannot reach the litigation files server), strict least-privilege access (attorneys can only access the client files their matter requires), and continuous authentication (re-verification when accessing sensitive systems or unusual behavior is detected).
Implementing full zero trust is a multi-year journey for most firms, but starting with network segmentation and least-privilege access delivers significant security improvements immediately.
Endpoint Detection and Response
Every laptop, desktop, and mobile device that connects to firm resources is a potential entry point. Endpoint Detection and Response (EDR) solutions go well beyond traditional antivirus by providing real-time monitoring of endpoint behavior, automated threat detection, and the ability to isolate compromised devices before an attacker can move laterally across the network.
Modern EDR platforms use behavioral analysis and machine learning to detect threats that do not match known malware signatures — including zero-day exploits and fileless malware that lives entirely in memory. For law firms, EDR deployed on all firm-managed endpoints should be a standard requirement, not an optional upgrade.
Mobile device management (MDM) provides similar control over smartphones and tablets, enforcing encryption, enabling remote wipe if a device is lost, and preventing personal applications from accessing firm data.
Email Security and Anti-Phishing Controls
Since phishing is the primary initial access vector, hardening email is one of the highest-return investments in law firm cybersecurity. A multi-layered email security approach combines several controls.
Domain-based Message Authentication, Reporting, and Conformance (DMARC), combined with Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM), prevents attackers from sending emails that appear to come from your firm’s domain. This protects your clients from attackers impersonating your attorneys — a critical safeguard during wire transfers.
Anti-phishing filters powered by machine learning analyze incoming emails for suspicious links, spoofed sender addresses, and social engineering language. These filters should be configured to quarantine suspicious messages rather than simply flagging them, as many users ignore warning banners and open the email anyway.
Attorney training is the essential complement to technical controls. Staff must be able to recognize spear-phishing attempts, understand the risk of business email compromise, and know exactly how to report suspicious messages. This is not a once-a-year video — it requires ongoing, realistic training with simulated phishing exercises.
Data Encryption at Rest and in Transit
Encryption ensures that even if an attacker steals data, they cannot read it without the decryption key. Law firms must implement encryption in two contexts: data at rest (stored data) and data in transit (data moving across networks).
Full-disk encryption should be enabled on every firm laptop, desktop, and mobile device. If a device is lost or stolen, encrypted storage makes the data inaccessible without the login credentials. Windows BitLocker and macOS FileVault provide full-disk encryption natively and should be enabled as a firm-wide policy, not left to individual attorneys to manage.
Data in transit must be protected with TLS 1.2 or later for all web applications, email transmissions, and API communications. Virtual Private Networks (VPNs) protect remote connections, though modern zero trust network access (ZTNA) solutions are increasingly preferred over traditional VPNs for their more granular access controls.
Privileged Access Management
Not everyone in your firm needs access to everything. A first-year associate working on a personal injury matter does not need access to M&A transaction files. The paralegal handling billing does not need administrative access to the document management system.
Privileged Access Management (PAM) enforces the principle of least privilege — giving every user only the access their current role requires and no more. PAM platforms also provide session monitoring and recording for privileged accounts (such as IT administrators), creating an audit trail that supports both internal governance and regulatory compliance.
Role-based access controls, combined with regular access reviews to revoke permissions when attorneys change practices or leave the firm, form the foundation of a least-privilege architecture.
Secure Cloud Usage and Virtual Data Rooms
Modern law firms are deeply reliant on cloud services — Microsoft 365, Google Workspace, cloud-based practice management platforms, and e-discovery tools. Cloud environments offer tremendous efficiency benefits, but they require deliberate security configuration.
Default cloud configurations are often insecure. Misconfigured cloud storage buckets, overly permissive sharing settings, and disabled security features are common findings in law firm security assessments.
For sensitive client documents and due diligence materials, virtual data rooms (VDRs) provide a controlled environment with granular permissions, access logging, dynamic watermarking, and the ability to revoke access remotely after a transaction closes. Firms that routinely handle M&A deals, real estate transactions, or litigation involving large document productions should standardize the use of VDRs for all external document sharing.
Read more: Cyber Insurance Requirements
Incident Response Planning for Law Firms
When a breach occurs — and for an increasing number of firms, it is a matter of when, not if — the quality of your incident response plan determines the extent of the damage you sustain.
Building a Legal-Specific Incident Response Plan
An incident response plan is a documented, rehearsed set of procedures that outlines exactly what your firm should do in the first minutes, hours, and days after a security incident. A generic IT incident response plan is not sufficient for a law firm. Your plan must account for the attorney-client privilege, professional responsibility obligations, client notification requirements, and bar ethics rules.
Your incident response plan should designate an incident response team that includes at minimum: a technical lead (internal IT or external MSSP), a managing partner or designated response authority, outside legal counsel (retained in advance, not hired in the middle of a breach), and a communications lead for client and public communications. Many firms designate outside counsel specifically to direct the breach investigation — work performed at counsel’s direction may be protected by work product doctrine, which is a meaningful litigation advantage.
The plan must establish clear decision trees: what constitutes a reportable incident under applicable state law, what triggers client notification under Rule 1.6, and under what circumstances to engage law enforcement or cyber insurance carriers.
Tabletop Exercises and Breach Simulations
A plan that has never been tested will fail under pressure. Law firms should conduct tabletop exercises at least annually — structured discussions where the incident response team walks through a realistic breach scenario and identifies gaps, decision bottlenecks, and communication breakdowns before an actual incident forces those discoveries.
Tabletop scenarios relevant to law firms include a ransomware attack that encrypts the matter management system on the eve of a major trial, a business email compromise that diverts client funds from a real estate escrow account, and a breach of a cloud service provider that exposes years of client communications.
Cyber Insurance for Law Firms
Cyber liability insurance has become a critical component of law firm risk management. Policies typically cover breach response costs (forensic investigation, notification, credit monitoring), ransomware payments and recovery costs, business interruption losses, and third-party liability from affected clients.
Insurers are increasingly requiring documented security controls before binding coverage — MFA, EDR, backup systems, and incident response plans are commonly required, not just recommended. Firms that cannot demonstrate these controls face higher premiums, reduced coverage limits, or coverage denial.
Before purchasing a policy, engage a broker with specific experience in the legal industry. Standard commercial cyber insurance products may not adequately address the unique liabilities of a law firm, including coverage for breaches of professional duty and the implications for the attorney-client privilege.
Read more: Cyber Defenses
Third-Party Vendor Risk Management
Law firms increasingly rely on a network of technology vendors, cloud providers, and service partners — all of whom represent potential security risks. Your firm’s security posture is only as strong as the weakest link in your vendor ecosystem.
Vetting Legal Technology Vendors
Before engaging any vendor that will access or store client data, your firm should conduct a security assessment. At minimum, this assessment should include reviewing the vendor’s SOC 2 Type II report (or equivalent security certification), their data breach history, their subprocessor relationships, and their contractual obligations to protect your data.
Practice management platforms, e-discovery vendors, court filing systems, legal research tools, and even document review AI platforms all have access to confidential client information. Treating vendor security reviews as a procurement formality rather than a substantive due diligence step is a significant, increasingly indefensible risk.
Data Processing Agreements and BAAs
Any vendor handling client data should sign a Data Processing Agreement (DPA) specifying how the data will be used, stored, and protected. Vendors that handle PHI must enter into a Business Associate Agreement (BAA) under HIPAA. These are not just contractual formalities — they establish liability and define the vendor’s obligations in the event of a breach.
Verify that the DPA includes breach notification requirements that align with your state’s notification timelines. A vendor that does not notify you of a breach for 60 days while your state requires client notification within 30 days creates a compliance crisis that is not your vendor’s problem — it is yours.
Read more: Cybersecurity Checklist for Gaming Companies
Law Firm Cybersecurity Best Practices by Practice Area
Different practice areas carry different cybersecurity risk profiles. Understanding these distinctions helps allocate security resources where the exposure is greatest.
Mergers & Acquisitions
M&A transactions involve some of the most sensitive and market-moving information. Nation-state threat actors, hedge funds, and industrial competitors have demonstrated a willingness to carry out cyberattacks against firms that handle large transactions. Firms practicing M&A should maintain stricter access controls for deal teams, use virtual data rooms for all external sharing, and consider air-gapped systems for the most sensitive deal communications.
Criminal Defense
Criminal defense attorneys work with some of the most motivated adversaries in the legal world — including government entities with significant surveillance capabilities. Attorneys representing clients in high-profile criminal matters should use end-to-end encrypted communication platforms for client communications. They should be alert to the risk of subpoenas targeting their communications infrastructure.
Immigration Law
Immigration files contain among the most sensitive personal information of any practice area — including country of origin, immigration status, criminal history in foreign jurisdictions, and family information. A breach of an immigration firm’s files can put clients at physical risk, not just financial or reputational risk. These firms should apply maximum data protection controls regardless of firm size.
Healthcare and Life Sciences
As noted above, firms that represent healthcare clients or handle medical records are subject to HIPAA. Beyond regulatory compliance, the sensitivity of health information means that breaches cause irreversible harm to clients’ personal lives. Encryption, strict access controls, and thorough vendor BAAs are non-negotiable.
Read more: 15 Essential Network Defenses
Building a Cybersecurity Culture in Your Law Firm
Technology controls fail without a culture that supports them. The most sophisticated security stack in the world cannot protect a firm whose attorneys believe that security policies are obstacles to productivity.
Security Awareness Training for Attorneys and Staff
Security awareness training in law firms often falls flat because it is generic — the same modules designed for retail employees are deployed to litigators. Effective training for legal professionals must be contextually relevant: examples drawn from legal-industry breaches, scenarios involving common law-firm workflows, and clear connections between security behaviors and professional responsibility obligations.
Training should cover phishing identification, safe handling of client data, password hygiene, mobile device security, the risks of public Wi-Fi, and firm-specific policies. Simulated phishing exercises — where the firm’s security team (or MSSP) sends realistic phishing emails to test who clicks — are among the most effective training tools available. Employees who click the simulation receive immediate just-in-time training, not punishment.
Training must be ongoing, not annual. Threat actors constantly evolve their tactics, and annual training does not keep pace. Monthly security tips, quarterly phishing simulations, and immediate communications when new threats emerge (such as a new phishing campaign targeting law firms) help maintain year-round awareness.
Creating Policies Attorneys Will Actually Follow
Security policies that attorneys routinely circumvent are worse than no policy at all — they create a false sense of security and complicate incident response. Policies must be designed for the legal workflow, not imposed from IT without attorney input.
The most effective law firm security policies are clear, concise, and explain the “why” behind each requirement. Attorneys are professional arguers — they respond better to policies when the rationale is transparent, and the risk is clearly explained. “You must use MFA because the loss of your credentials would result in a client data breach that triggers our bar notification obligations” is far more persuasive than IT requires MFA per firm policy.
Policy areas that every law firm should formalize include acceptable use of personal devices for firm work, remote work security requirements, cloud service approval procedures, client communication encryption requirements, and physical security for printed documents.
The Role of Managing Partners in Security Leadership
Cybersecurity culture starts at the top. When managing partners treat security as an IT problem rather than a firm leadership priority, that message cascades through the organization. When managing partners are visibly engaged in security — attending training, asking questions about the firm’s risk posture in partner meetings, and making investment decisions based on security considerations — the entire firm follows.
The firms with the strongest security cultures are those where cybersecurity sits on the partner meeting agenda as a regular business matter, not as an occasional IT update.
Read more: Cybersecurity Checklist
Responding to a Law Firm Data Breach
Despite best efforts, breaches happen. Knowing how to respond quickly and correctly determines whether a breach becomes a catastrophe or a contained incident.
The First 24 Hours
The first 24 hours after discovering a breach are the most critical. The immediate priorities are containment, preservation of evidence, and escalation to the incident response team.
Containment means isolating affected systems to prevent the attacker from moving further across the network or exfiltrating additional data. This may mean taking systems offline, resetting credentials, or blocking suspicious IP addresses. However, containment must be balanced against evidence preservation — actions taken in panic can destroy forensic evidence needed to understand the full scope of the breach and meet regulatory reporting requirements.
Engage your outside breach counsel and your cyber insurance carrier immediately. Breach counsel will direct the forensic investigation under the work-product privilege and advise on notification obligations. The insurance carrier may have preferred forensic vendors and breach response services that are covered under your policy.
Do not communicate about the breach via potentially compromised email systems. Have an out-of-band communication channel — a dedicated phone bridge or a separate communication platform — designated in advance for breach communications.
Client Notification Obligations
Notifying clients of a data breach is one of the most difficult conversations in legal practice. The obligation is real — under both professional responsibility rules and applicable law — and the timing is critical. Late notification erodes client trust far more than early, transparent notification.
Client notification should come from a partner, not from an IT department email blast. The communication should acknowledge what happened, which data may have been affected, what steps the firm is taking to investigate and remediate, and what the client should do to protect themselves. If your firm has determined that attorney-client privilege was implicated, that determination and its legal implications should be addressed with the client’s own counsel in a separate, privileged communication.
Key Takeaways
Cybersecurity for law firms is not an IT issue — it is a professional responsibility, a client protection obligation, and a business survival imperative. Every attorney who touches client data has a duty of competence that extends to understanding and managing the digital risks to that data.
The firms that will weather the intensifying cyber threat landscape are those that treat security as a core practice management function, invest in proportionate technical controls, train their people continuously, and plan their incident response before they need it.
Your clients trust you with their most sensitive secrets. That trust demands the most rigorous protection you can provide.
Frequently Asked Questions (FAQs)
What are the most common cybersecurity threats facing law firms today?
Law firms most commonly face phishing attacks, ransomware, business email compromise, and insider threats. Phishing is the leading initial access vector, often used to steal credentials or deploy malware. Ransomware specifically targets firms because the legal and reputational pressure to recover data quickly gives attackers leverage.
Are small law firms required to implement cybersecurity measures?
Yes. Professional responsibility obligations under ABA Model Rules 1.1 and 1.6 apply to all attorneys regardless of firm size. Additionally, state data breach notification laws, HIPAA (where applicable), and other regulations apply based on the type of data handled, not the size of the firm. Small firms are actually disproportionately targeted because they often have weaker defenses than large firms.
Does a data breach automatically waive attorney-client privilege?
Not automatically, but a breach creates serious privilege risk. Courts evaluate whether the firm took reasonable precautions to protect privileged communications. Firms with strong, documented security practices are far better positioned to argue that privilege was maintained despite the breach. This is one of the strongest arguments for proactive cybersecurity investment.
What is multi-factor authentication and why do law firms need it?
Multi-factor authentication (MFA) requires users to verify their identity using at least two methods — typically a password plus a code from an authenticator app or hardware token. MFA blocks the vast majority of credential-based attacks, including those resulting from phishing. Every account with access to client data should require MFA.
How should law firms handle vendor cybersecurity due diligence?
Firms should require vendors to provide security certifications (such as SOC 2 Type II reports), sign Data Processing Agreements specifying data protection obligations, and, if PHI is involved, sign Business Associate Agreements. Vendor security should be reviewed at contract initiation and periodically thereafter. Vendors should be contractually required to notify the firm of any breach within a timeframe that allows the firm to meet its own notification obligations.
What should be included in a law firm incident response plan?
An effective law firm incident response plan should designate an incident response team (including outside breach counsel and insurance carrier contacts), define what constitutes a reportable incident, establish client and regulatory notification timelines, include procedures for evidence preservation and system containment, and be tested through annual tabletop exercises.
How does cybersecurity relate to attorney-client privilege?
The duty to protect the attorney-client privilege is a core professional responsibility. Digital security controls — encryption, access controls, MFA, and secure communication platforms — are the mechanisms that protect privilege in modern legal practice. Courts are increasingly examining whether law firms took “reasonable precautions” to safeguard privileged communications when privilege disputes arise following a breach.
