Client Financial Data: What a Law Firm, CPA or Wealth Advisor Is Really Holding

The closing binders in the scanned folder

A paralegal at a 40-person law firm has scanned every real-estate closing binder for eight years. It is good practice: the paper goes to storage and the PDF stays searchable. Each binder holds the client's bank statements, the lender's payoff letter and the transfer instructions.

The binders also hold a copy of each client's passport.

The scans live in a folder on the document management system called "Closings, all years." Permissions were set when the firm had twelve people. Every user has read access, because in 2018 that was easier than asking who needed it. The firm now has 40 people, including four summer associates, two contract attorneys and an IT vendor with an admin account.

On a Tuesday in July, one of the summer associates, working from a coffee shop, opens a phishing email that looks like a court e-filing notice. Her password goes to someone in another time zone. For nine days that someone reads the document management system as her. The firm's audit logs, which default to 30 days and which nobody reviews, show 2,140 documents opened from an IP address in a country the firm has no clients in.

The managing partner learns the scale on day ten. He now has to work out which of 900 closings are affected, whose bank statements were among them, and which regulators should already have heard about it.

What the heck does this mean

Client financial data is any record that ties an identifiable person to their money: statements, tax returns, loan files, brokerage records, wire instructions, payroll details. Law firms, CPAs and advisors hold more of it per employee than most banks.

Under the federal PDPL, that data is personal data, and the firm holding it answers for it. A firm in the DIFC or ADGM answers under its free zone's own data protection law, and a DFSA, FSRA or CBUAE licensee answers to its sector regulator too.

A WISP, written information security program, is the document that says what you hold, who protects it and how. It is what a regulator or a client asks to see after an incident.

Least privilege is the principle that a person can open only what their job requires. "Everyone can read Closings, all years" is its opposite.

Business email compromise, BEC, is the attacker using a stolen or spoofed mailbox to redirect money. In a law firm the target is the wire instructions in the closing folder, and the settlement funds that follow them.

The numbers that matter

Under the federal PDPL, the UAE Data Office is notified of a qualifying breach on becoming aware of it. A firm in the DIFC or ADGM follows its free zone's own notification rule, and a wealth advisor licensed by the DFSA, the FSRA or the CBUAE has a sector regulator to tell as well. The clock starts on discovery, which is why nine days without anyone noticing matters.

In the United States, business email compromise cost USD 3.05 billion across 24,768 complaints (FBI IC3 2025 Annual Report). Every one of those complaints started with someone reading email that was not theirs, which is exactly what the summer associate's stolen password allowed.

What to do this week

1. Open the permissions on your three biggest client folders and count how many people can read them. Cut the list to the people working those matters. Do closings, tax returns and client statements first. (CIS 6 Access Control Management)
2. Turn on MFA for the document management system, email and the remote-access tool, including for contract staff and the IT vendor. A stolen password without a second factor is a key; with one, it is a key to a locked door. (CIS 6 Access Control Management)
3. Extend your audit log retention to at least a year and assign one person to review the "documents opened" report every Monday for the unusual: volume, hour, location. The nine days in the story would have been one. (CIS 8 Audit Log Management)
4. Find the financial data outside the system: the paralegal's scan folder on her desktop, the shared inbox of wire instructions, the spreadsheet of client account numbers in the finance department. Move it in or delete it. (CIS 3 Data Protection)
5. Write, or rewrite, the WISP with real names: who owns it, which systems hold client data, which vendors have access, and the phone number of the lawyer you will call on day one of a breach. Date it and put a calendar reminder to review it in twelve months. (CIS 3 Data Protection)
6. Add a callback rule for wire instructions: any change is confirmed by phone to a number on file, never to a number in the email. Put it in the engagement letter so clients expect it. (CIS 3 Data Protection)

Where AccuSights fits

Our assessment finds the client financial data your firm holds, shows who can reach it, and checks whether the logs would answer "what did they open". The Cyber Hygiene Test takes three minutes. A 30-minute call with your Risk Assessor turns the permissions problem into a short, costed list.

We map the assessment to the PDPL and, for DIFC and ADGM firms, the free-zone data rules, and our read-only compliance agent shows where client data sits and which controls have drifted, so you prioritize the right things and keep an eye on them. We have no access and do not remediate; you or your IT partner fix, and we show you where.

Your clients handed you their bank statements because they trusted you more than the bank. The folder permissions should say the same thing.