Unfamiliar correspondence is rarely random
A letter referencing a loan your firm never applied for, an email welcoming you to a service you did not purchase, a notice from a government agency about benefits you did not request. These are the most common early indicators. The sender may be legitimate; the account is not. Criminals open accounts using stolen identifiers and let the legitimate institution send the welcome packet. The return address on the envelope or the domain in the email header will match the real organization. That legitimacy is the trap. It convinces recipients to dismiss the notice as a clerical error.
Credit reports reveal what mail hides
Not every fraudulent account generates physical mail. Many exist only in credit files. A quarterly review of your practice's credit reports across the three major bureaus will surface hard inquiries you did not authorize, new tradelines you did not open, and address changes you did not request. The Fair Credit Reporting Act entitles you to one free report from each bureau every twelve months. Spacing those requests every four months creates a rolling view without cost. Commercial monitoring services automate the cadence and alert on changes in near real time, but the underlying data is the same.
Client reports of impersonation demand immediate triage
When a client calls to verify an email they received from "your office" requesting wire instructions or credential confirmation, treat it as a confirmed breach indicator. The attacker already possesses enough context to craft a convincing lure. That context came from somewhere: a compromised mailbox, a breached vendor, a phishing harvest. Assume the worst scope until evidence narrows it. Notify your cyber insurance carrier the same day. Preserve the suspicious message with full headers. Begin credential rotation for every system the impersonated account could access.
Credential rotation follows a strict priority order
First: financial accounts, domain registrars, DNS providers, email administration consoles, and any system that can reset passwords for other systems. Second: practice management platforms, electronic health record systems, document management repositories, and client portals. Third: every account where the same password or a predictable variation was reused. A password manager makes this systematic rather than frantic. If you do not use one, the rotation effort becomes the business case for adoption.
Credit freezes outpace fraud alerts
A fraud alert asks lenders to verify identity before extending credit. A credit freeze blocks access to the credit file entirely until you lift it. For a practice that does not seek new credit lines regularly, the freeze is the stronger control. It is free, does not expire, and can be lifted temporarily for a legitimate application. Apply the freeze at all three bureaus. Apply it to the practice entity and to the personal files of every partner or principal whose identifiers appear on business credit.
Law enforcement reporting creates the paper trail insurers require
File a report with your local police department. Obtain a copy. File an identity theft report with the Federal Trade Commission at IdentityTheft.gov. The FTC report generates a personalized recovery plan and serves as the official record for creditors, bureaus, and your cyber policy. Many insurers will not honor a claim without both reports. The police report also establishes a date of loss for any subsequent litigation or regulatory inquiry.
Vendor breach notifications often arrive late
When a software vendor or cloud provider discloses a breach, assume your data was exposed even if the notice says "no evidence of misuse." Evidence of misuse appears months later. Rotate the credentials used for that vendor immediately. Review access logs for anomalous authentication patterns during the exposure window. If the vendor cannot provide logs, treat the integration as fully compromised and rebuild it from a clean state.
Regulatory obligations vary by sector
Law firms must consider Rule 1.6 confidentiality obligations and state breach notification statutes. Healthcare practices must evaluate HIPAA breach notification rules and state health privacy laws. Financial services firms face GLBA Safeguards Rule requirements and SEC or state regulator expectations. The identity theft event may trigger mandatory notification to clients, regulators, or both. Engage counsel before sending any notification. The wording determines whether the notice limits or expands liability.
Post-incident architecture changes prevent recurrence
After containment, the practice needs architectural changes: mandatory hardware security keys for administrative accounts, conditional access policies that block authentication from unmanaged devices, encrypted email for all client communications, and a documented incident response plan with assigned roles and quarterly tabletop exercises. The cost of these controls is a fraction of the cost of a second incident. The second incident is rarely survivable for a small practice.
Monitoring is a continuous function not a project
Identity theft protection does not end when the immediate crisis passes. Credit monitoring continues. Dark web monitoring for the practice domain and principal identifiers continues. Phishing simulation campaigns continue. The threat actors who harvested the data initially will test it against new targets for years. The practice that treats monitoring as a standing operational expense rather than a one-time project cost is the practice that detects the next attempt before it becomes a breach.