Client intake records are forms, questionnaires, and notes collected when a person first seeks services. They may contain names, contact details, identity information, financial circumstances, and a summary of the matter. In a law practice, these records can be sensitive even before a formal case begins.
Because intake information can support identity fraud, targeted scams, or coercive pressure, organizations should restrict access, protect stored and transmitted data, and retain it only as long as necessary. In an attack, criminals may seek these records alongside case files and billing documents; an extortion claim alone, however, does not prove that records were accessed or exposed. Defenders should verify access and data-transfer evidence before concluding what was affected.