This Week in Security: September 23, 2026

This week, security researchers reconstructed a three week ransomware attack using endpoint data alone. The investigation revealed something unsettling: attackers were present in the network for 17 days without taking visible action, a dormant period that occurred despite gaps in the victim's process telemetry. Only after this lull did the attackers move forward with encryption and drop their ransom note, meaning the intrusion was well underway long before anyone noticed.

Why this matters for your firm

The timeline matters more than the ransomware itself. Most small practices assume a breach looks like an immediate, obvious event, but this case shows attackers can sit quietly inside a network for weeks, reading files, mapping systems, and waiting. If that dwell time happens inside a firm's network, client intake records, case files, and trust account details could be exposed long before any ransom note appears.

Florida Bar Rule 4-1.6 and Recommendation 25-1

Rule 4-1.6 requires attorneys to make reasonable efforts to prevent unauthorized access to client information, and that duty does not stop at prevention. It extends to having the visibility to detect an intrusion in progress. Recommendation 25-1 reinforces this by pushing firms toward documented cybersecurity assessments, the kind of paper trail that demonstrates reasonable efforts were actually in place, not just assumed.

What to do this week

1. Confirm your endpoint protection logs full process activity, not just alerts, since incomplete telemetry is exactly what made this timeline hard to reconstruct.
2. Review account and login activity from the past month for anything unusual or dormant that suddenly became active.
3. Get a documented risk assessment on the calendar so you have evidence of reasonable efforts if a regulator or client ever asks.

How ArisGate helps

This is precisely the kind of gap ArisGate exists to close for solo and small Florida law firms, the quiet weeks between intrusion and impact where visibility matters most. Schedule a free security audit with ArisGate this week and know where you actually stand.