A couple of months ago, the New York State Bar Association Committee on Professional Ethics issued an opinion on an interesting question: “When a lawyer’s former client posts accusations about the lawyer’s services on a website, may the lawyer post a response on the website that tends to rebut the accusations by including confidential information relating to that client?”
Holding that the "self-defense" exception to the duty of confidentiality does not apply to this type of case, the Committee answered "no." You can read the opinion (Opinion 1032 (10/30/2014)) here. The Committee finds that the "self-defense" exception should be limited to cases involving allegations of lawyer wrongdoing in formal proceedings such as legal malpractice or other civil actions, disqualification proceedings, or sanctions motions.
The result seems sensible to me. An ttorney would not be allowed to discuss confidential information about this matter with another person (say, someone who read the review and asks the attorney about it), so it would make sense the attorney can't disclose the information to the world at large. In both instances, the attorney is not "defending" against an action by the client but addressing comments made by the client. Take the website aspect out the equation and what you have is a former client talking to others and the attorney wanting to take a chance to give his/her side of the story to the same audience. The attorney is free to do so, but can't disclose confidential information in the process.
The fact the comments are "published" (on the website) and can reach a much wider audience should not change the analysis. The Committee suggested, however, that the answer might be different if client had somehow waived his expectation of confidentiality by posting the comments. The Committee did not address that possibility because question was not presented by the facts before the committee.
h/t The Lawyers Ethics Alert Blog