A client hired our firm to maintain a collection of websites, 12 in total. Our maintenance services include a couple of items particular to security: namely scanning the website for malware and removing malware if found. One of those websites is actually owned by a third party.
The third party reached out and said they found a number of security issues. The majority of issues were with subdomains -- which are different websites and we bill separately for them -- which is to say we were not maintaining these additional websites.
Amongst the issues found that were particular to the website we maintained were an SSL certificate (what allows a site to load https:// "secure" -- though this functionality itself was not broken) that was not installed properly prior to our firm inheriting the site.
Additionally, the site is on a CMS that by default has a URL where you can see limited information about users accounts on the site. We reinstalled the SSL and prevented anyone from being able to visit the URL where user information was available. We also assisted with a number of the subdomains issues.
We did all of this at no additional cost though it is outside the scope of our flat rate monthly maintenance. Additionally, we discounted the client's invoice by about 1/6 (after explaining to the client that we did all the work we are contracted for and more, and after the client refused to pay and threatened to fire us).
We also did a call with the third party and our client to discuss the security issues. We noted the work we did to meet their concerns and provided context for our company. On the phone call the third party said they wanted to host the site themselves, but would continue to work with our client.
Two months later our client decided that they were no longer going to work with us and decided to not to pay the last monthly invoice. We informed the client that we are fine with the separation, offered to complete any pending monthly maintenance work and informed the client that though they was cancelling on the 30th of the month we would not hold them to the contract of needing to provide x days notice, and rather close their contract immediately, but they would still owe their final invoice for the preceding 30 days.
The client refused to pay and threatened to sue for loss of work and damages. We politely informed client when their invoice was due, when it would become past due, when it would reach a point were under the contract penalties could be charged -- noted we would extend this timeframe and had no interest in charging penalties if they would simply close the invoice. All steps resulted in additional threats that we would be hearing from their attorneys.
Please advice if it is worth pursuing the unpaid invoice and any risk of being sued for damages/lost third party client.