No organization is immune from data breaches. That's pretty much the first rule. All you can do is mitigate the risk, you can't eliminate it. Being a law firm that handles data breaches certainly doesn't make them unhackable, especially if it makes them a target.