Irwin Kramer notes that law firms who suffer a ransomware attack may have an ethical requirement to report the incident to clients:
Because law firms maintain huge repositories of sensitive data, they are particularly vulnerable to such attacks. You may not be able to prevent all attacks, but you should consult with a cybersecurity expert to improve your resistance to them. When all else fails, don’t compound the problem by concealing it from affected clients. If you do, your data breach will morph into a breach of ethics.
Another major incentive to take measures to reduce vulnerability to such attacks. The threat is real and the consequences for your legal practice can be severe.