If the data on that hard drive was encrypted, rather than sitting out there for anyone to see, the headline might have been entirely different. All the thief would be able to see would be a file, partition, or drive full of gobbledygook (that’s a technical term). Encrypt your law firm data.
At the same time, reconsider carefully the data you do hold onto. Do you really need your client’s social security number or driver’s license number? If you do, you had better encrypt that information and keep any paper copies under lock and key. It will take more than a simple log-in password to escape liability in a case like this, I think.