You’ve vetted your firm’s cyber security. Your staff use multi-factor authentication, your computers are patched, your data is backed up, and your IT provider keeps an eye out for suspicious activity.

Then one of your technology vendors has a cyber security incident. Suddenly, your firm’s risk depends on systems you don’t own and security decisions you didn’t make.

That’s the scenario Ontario’s justice system faced this summer. On June 30, 2026, Thomson Reuters Canada detected unauthorized activity within one of its cloud environments. The affected environment supported C-Track, the case-management platform used by the Court of Appeal for Ontario, Superior Court of Justice, and Ontario Court of Justice to store and manage some court documents and records.

Thomson Reuters later determined that the accessed data included some information from Ontario courts and notified the Ministry of the Attorney General on July 23. When Ontario’s three Chief Justices publicly disclosed the incident on September 2, the investigation was still determining exactly what information had been accessed and how many people could have been affected.

For law firm managers, there’s an important lesson here. Your cyber security doesn’t end at the edge of your own network: outside providers may store or access some of your firm’s most sensitive information.

Your Vendors Are Part of Your Security Environment

Think about how many outside platforms your firm uses during a normal workday. Your document management system may be hosted in the cloud, while your staff may use an online accounting platform, payroll provider, practice management system, or remote-access tool.

Each supplier that stores or accesses firm information becomes part of your cyber security risk profile. If one of those providers experiences unauthorized access, your information may be involved even though your own network was never compromised.

That doesn’t mean cloud services are inherently unsafe. In many cases, reputable cloud providers have far greater cyber security resources than an individual firm could maintain internally, but the C-Track incident shows that even a large, established technology company can experience unauthorized activity.

When you choose a vendor, you’re also making decisions about where your firm’s information goes, who may have access to it, and how the provider will respond if something happens. Those questions deserve the same attention as price, features, and ease of use.

Vendor Due Diligence Needs to Go Beyond the Sales Demo

Most software selection starts with features, price, compatibility, and usability. Cyber security needs to be part of that conversation before the contract is signed.

Before approving a provider that will handle sensitive firm or client information, find out how it protects that data. Ask where information will be stored, how access is controlled, what encryption is used, how backups are handled, and what security standards or independent audits the provider follows.

You should also ask what happens if the provider has a breach. Find out how quickly it will notify your firm, what information it will give you, who will investigate, and what assistance will be available during your response.

A vendor may have strong security controls and still experience an incident. How quickly and openly it responds can affect your firm’s ability to protect clients, employees, and business information.

Know What Information Your Vendors Have

If one of your providers called this afternoon and said its environment had been compromised, could you immediately identify what firm information might be there? For many firms, the answer isn’t obvious because data can spread across multiple platforms over time.

A new application may be adopted for one department, then connected to another platform later. Files get uploaded for individual projects, old accounts remain active after employees leave, and years can pass without anyone documenting exactly what information is being stored in each service.

A simple vendor and data inventory can make incident response much easier. Record which external providers your firm uses, what information each one receives or stores, which employees have access, and who internally owns the relationship. Include the renewal date and the person responsible for reviewing the vendor’s security. That way, if an incident occurs, you won’t have to reconstruct your technology environment while everyone is already under pressure.

Review the Contract Before Something Goes Wrong

Cyber security language can get little attention when a technology contract is being negotiated. But after an incident, those same provisions can become some of the most important terms in the agreement.

Your contracts with technology providers should address security responsibilities and breach notification. Depending on the service, you may also want provisions dealing with data location, subcontractors, access controls, encryption, retention and deletion, audit rights, insurance, and what happens to your information when the relationship ends.

Pay particular attention to notification requirements because your firm’s response may depend on receiving timely information. In the C-Track incident, Thomson Reuters detected unauthorized activity on June 30 and later advised the Ministry on July 23 that accessed data included Ontario court information, while the public announcement followed on September 2.

Your Incident Response Plan Should Include Vendor Breaches

Most firms picture a cyber incident as something happening directly to their own network. Ransomware, a compromised email account, a stolen laptop, or an employee clicking a malicious link may be the examples that first come to mind.

Your incident-response plan should also cover a call from a supplier saying its systems have been breached. That scenario can require your firm to make decisions even though you don’t control the investigation or the affected infrastructure.

The Law Society of Ontario recommends that firms prepare an incident-response plan addressing events such as unauthorized access and data breaches. It also recommends safeguards for electronic information, including protections for information stored using cloud services.

Your plan should identify who needs to be contacted, who has authority to make decisions, how affected systems or accounts will be reviewed, and how you’ll determine what information the vendor held. It should also explain who contacts your IT provider, insurer, privacy counsel, senior management, and affected clients when those communications are required.

What Law Firm Managers Can Do Now

You don’t need to replace every cloud platform your firm uses. You do need to know what your suppliers are doing with your information and have a plan for responding if one of them experiences a security incident.

●      Create a vendor inventory. List every outside provider that stores, processes, transmits, or can access firm information. Include smaller services purchased directly by individual departments because they can be easy to overlook.

●      Map your data. Identify what each vendor holds, including client files, employee information, billing records, email, identification documents, and financial information. Knowing the type of information involved can help you assess the impact of an incident much faster.

●      Review access. Remove accounts belonging to former employees and check that current users only have the permissions they need. Excess access can create unnecessary exposure if a vendor account or system is compromised.

●      Check your contracts. Review breach notification, security responsibilities, data retention, subcontractors, and termination provisions before renewal dates arrive. If the wording is vague, raise the issue while you still have room to negotiate.

●      Ask vendors about cyber security. Security reviews shouldn’t happen once during procurement and then disappear. Revisit them periodically as the service, your data use, and the provider’s technology change.

●      Practice your response. Run a tabletop exercise in which a major technology provider tells you that firm data may have been accessed. See how quickly your team can identify the affected information, responsible decision-makers, and next steps.

The Bigger Lesson

According to the September 2 statement, there was no evidence at that point that the C-Track incident had resulted in identity theft, and no indication that systems processing financial transactions for court proceedings had been affected. Thomson Reuters had also implemented further safeguards, and the courts said C-Track remained operational and safe to use. That doesn’t make the incident irrelevant to firms: rather, it makes it a useful example of how cyber risk can reach an organization through a trusted supplier rather than through its own systems.

Law offices rely on outside technology because modern legal work depends on interconnected services. Outsourcing a service, however, doesn’t remove the need to know what information the provider holds, what protections are in place, and what your firm will do if those protections fail.

Your own cyber security plan may be strong, but that’s only part of the picture. You also need to know how prepared the organizations connected to your firm are, and how quickly you can respond when a problem begins somewhere else.

Nolan is an expert in IT for law firms. In 2024 he became CEO of IT support company Inderly, local to Hamilton, Toronto and Stratford, and serving law firms across Ontario.  

When not leading the Inderly team, Nolan can usually be found writing and shooting independent films, playing D&D, or enjoying Toronto’s best theatre productions and concerts.