How a Shared Google Login Almost Cost a Kingston Law Firm Their Cyber Insurance

The situation

A Kingston law firm asked us to review their cybersecurity ahead of a cyber insurance renewal. Their insurer had sent over a long questionnaire about how the firm secured client files, practice data and staff accounts. Standard process for any firm renewing coverage in Eastern Ontario right now.

The firm was already on Microsoft 365 with a solid baseline. Security hardening was in place. Retention policies were configured. Device controls covered every workstation and phone. On paper, they looked compliant.

What we found

Walking through how staff actually worked, we noticed something off. Several team members were signed into a Google account in Chrome throughout the day. The head lawyer had set up a personal Gmail years earlier to host a shared calendar, and the team had been logging into it ever since.

The calendar itself was the obvious problem. Schedule data, client meetings and court dates were all sitting in a personal Google account, outside the firm’s retention and security policies.

The bigger issue was the browser. Every staff member was signed in to the same Google account in Chrome. Saved passwords, auto-filled form data, login sessions, all of it was syncing across every workstation that used that account. Anyone who hit “remember password” had just shared that password with the rest of the team.

Two failures stacked together. First, client-adjacent data living outside the firm’s controls. Second, shared credentials with no record of who accessed what.

What we did

We wrote up a short report for the partners. The initial reaction was concern. The real reaction, once it sank in, was relief that we’d caught it before the questionnaire went back to the insurer.

The fix was a clean migration:

• Moved the calendar into Microsoft 365 with delegated access, so each staff member had only the permissions they actually needed
• Rolled out a corporate password manager to every team member
• Used the saved credentials in the old Google account as a “must change” list and rotated each one
• Signed everyone out of the Google account and removed it from the firm’s Chrome profiles

Staff kept the same calendar functionality they were used to. The partners kept their insurance renewal on track.

The takeaway

Cyber insurance questionnaires are getting more specific every year, and answering them honestly often surfaces gaps you didn’t know you had. If your Kingston or Eastern Ontario firm is heading into a renewal cycle, it’s worth having someone walk through how your team actually works, not just how the policies are configured.