When staff leave with client files: insider risk at law and accounting firms

Firms spend most of their security attention on strangers overseas. Yet some of the most damaging incidents at law and accounting firms start with someone who already has a login.

Insider risk isn't mostly about villains. It's about the associate who takes a client list to a competitor, the bookkeeper who emails a return to the wrong “John,” and the assistant who pastes a settlement memo into a free AI tool to tidy it up. Each one can be a reportable incident.

Six ways it shows up at a firm

1. Taking files on the way out. A lawyer or accountant leaving for another firm downloads client files, contact lists or work product in their last few weeks.
2. Sabotage. Rare, but real: an unhappy employee deletes folders, changes passwords or locks others out on the way out the door.
3. Looking where they shouldn't. Staff open a high-profile matter or a celebrity client's return out of curiosity. At a law firm, this can also breach an ethical wall.
4. Honest mistakes. Autocomplete picks the wrong recipient, a document goes out with tracked changes still in it, a laptop is left in a car. These are the most common incidents by far.
5. Shared logins. A paralegal works under an attorney's account, or a preparer uses a colleague's login to the tax software. When something goes wrong, you can't tell who did what.
6. Unapproved AI. Client documents get pasted into public AI tools where the firm has no control over what happens to them.

Warning signs worth an alert

• Bulk downloads from the document management system or file server, especially after a resignation.
• Email rules that forward to a personal address, or files uploaded to personal cloud storage.
• Access to matters or clients the person isn't assigned to.
• USB drives in use on machines that normally never see one.
• Security software disabled or uninstalled.
• Sudden use of AI tools or sites nobody approved.

No single signal proves anything. Patterns do, and only if someone is looking.

What actually reduces the risk

1. Give access by matter or client, not by department. People see the files their work needs. It limits damage and makes ethical walls enforceable.
2. Turn on alerts for mass downloads and forwarding to outside addresses. Microsoft 365 can do much of this with the right licensing.
3. Make offboarding same-day. Accounts disabled, devices collected, shared passwords changed, mailbox handed to a supervisor. Write the checklist once and use it every time.
4. One person, one login. No shared accounts for the case management system, the tax software or the bank.
5. Publish an AI policy with an approved tool for client work and a short list of what must never be pasted anywhere else.
6. Catch misdirected email with external-recipient warnings and a short send delay. Small friction prevents a lot of breach letters.
7. Keep the logs. If someone does leave with files, you need to be able to show what was taken and when. That matters to your clients, your carrier and, for law firms, your duties under the professional conduct rules.

None of this assumes your people are dishonest. It assumes they're human, which is the safer bet.