Cybersecurity for Legal Firms Guide: Threats, Regulation and Priority Controls

Law firms hold client money, privileged documents and deal information that criminals and states both want, yet many run on outsourced IT, shared mailboxes and payment processes that still trust an email. The pattern in the legal sector is consistent: phishing and email modification fraud drive most reported incidents, ransomware now steals case files before it encrypts them, and a compromise at one supplier or chambers spreads to many firms. This guide covers the legal sector threat picture, the professional and data protection duties that turn a cyber incident into a regulatory matter, and the controls that matter more in a firm than in a typical business: payment verification, matter-level access, email authentication and recovery of practice systems. It is written for IT and security leads, COLPs and compliance partners, practice managers at smaller firms, and the managed service providers that support them. For the identity layer in depth, see the Law Firm Identity and Data Security Guide.

Key takeaways

• Email is the main attack surface. The SRA reported that over 80% of the cybercrime reports it received in 2021 involved email, and phishing and email modification made up about half of all reports.
• Every payment instruction needs a second channel. Conveyancing and completion monies are the prize in business email compromise; a call-back to a number held on file stops most of it, whatever the email filter misses.
• Confidentiality is a professional duty, not only a privacy one. SRA codes, ABA Model Rules 1.1 and 1.6 and data protection law all apply at once, so a single incident can mean reports to the ICO, the SRA and clients.
• Basic controls have been enforced. The ICO fined Tuckers Solicitors £98,000 after a 2020 ransomware attack, citing no MFA on remote access, a patch applied five months late and unencrypted archive data.
• Suppliers and chambers are part of your perimeter. The NCSC and SRA both describe incidents at IT providers and a barristers' chambers that spread to multiple firms; supplier assurance belongs in engagement terms.

Why law firms are a distinct target

The NCSC's Cyber Threat Report on the UK legal sector (June 2023) sets out why firms of every size are attractive. Firms handle large sums of money and highly sensitive information such as merger and acquisition details and criminal case material. Disruption is expensive and reputation is the product, which gives extortion leverage. Clients trust lawyers, and attackers exploit that authority in impersonation fraud. The report notes nearly three quarters of the top 100 firms had been affected by cyber attacks, and that in a 2020 SRA review 30 of 40 firms visited had been targeted.

• Money in transit: client account transfers in conveyancing, probate and transactional work, often on deadlines that discourage checks.
• Information with market value: unannounced deals, litigation strategy, intellectual property and government work, which the NCSC links to state actors from China, Russia, Iran and North Korea, sometimes acting through criminal groups.
• Fragmented estates: partnerships with autonomous practice groups, fee earners working from home and court, and smaller firms that outsource all IT to one provider.
• Sensitive individuals: human rights and political cases expose lawyers to commercial spyware, which the NCSC report identifies as a risk.
• Long retention: files kept for years after a matter closes, often on archive servers that receive less attention than the live document management system (DMS).

Threat picture

The table maps the threats most reported against law firms to ATT&CK v20 techniques and the control that does most to stop each.

The SRA's Risk Outlook on information security and cybercrime (June 2022) adds detail. Conveyancing remains a frequent target for email modification but criminals have extended it to other practice areas, and even intercepted physical post to request funds. Ransomware reported to the SRA increasingly involved stealing data and threatening to publish it, and the SRA recorded 18 ransomware attacks in 2021 while noting that figure counts only cases where client information was affected. It also warned that voice and video impersonation, already seen in other sectors, was likely to reach solicitors. See the Business Email Compromise Response Playbook and the Ransomware Prevention Guide.

Professional duties and regulation

A law firm answers to its professional regulator as well as to data protection law and its clients' contracts. The table summarises the main obligations in the UK and US; check the current text with each regulator, as rules and guidance are revised.

Two practical consequences follow. First, the incident response plan needs a named owner for each notification route (ICO, SRA or state bar where relevant, clients, insurers, police or Action Fraud) and a way to decide quickly whether privileged material was accessed. Second, client outside counsel guidelines are often the strictest standard a firm has signed up to, so they belong in the control baseline, not in a drawer. See the UK GDPR and Data Protection Act 2018 Guide and the Data Breach Notification Checklist.

Payment diversion and client account controls

Most of the money a law firm loses to cybercrime leaves through a legitimate transfer that someone was persuaded to authorise. Technical controls reduce the number of convincing emails; process controls stop the transfer.

1. Publish your bank details once and say they will not change: put the firm's account details and a warning in the client care letter and on the website, and tell clients the firm will never change them by email.
2. Verify every incoming change by call-back: any new or changed bank details from a client, another firm or a supplier are confirmed by phone on a number taken from the file or an independent source, never from the email that asked for the change. Record who called, when and which number.
3. Use dual authorisation in the banking platform: one person sets up a payee, another approves the payment, with thresholds that match the firm's typical completion sums. Use confirmation of payee or account name checking where the bank offers it.
4. Slow down Friday afternoons: completion deadlines are exploited; agree internally that a payment can wait an hour for verification, and that a partner will back a fee earner who delays.
5. Know the recall route: keep the bank's fraud line, Action Fraud and the firm's insurer contact on the payment desk, because recovery chances fall fast after the funds move.

Email authentication supports these steps. Publish SPF, DKIM and DMARC on every domain the firm owns, including parked ones, and move DMARC towards p=reject once legitimate senders are aligned. The NCSC legal sector report also recommends considering a takedown service for domains impersonating the firm. Lookalike domains cannot be blocked by DMARC, so external email banners and staff awareness remain necessary. See the Email Security Guide.

Protecting matters, documents and archives

• Matter-level access in the DMS: default access by matter team, with ethical walls (information barriers) enforced in the DMS and in email and collaboration tools, not only recorded in a conflicts register. Review membership when people move teams.
• Archive servers and old files: the Tuckers attack encrypted 972,191 files on an archive server that held unencrypted personal data. Apply the same patching, MFA and encryption standard to archives as to live systems, and enforce retention schedules so closed matters are destroyed on time.
• Secure file exchange: use a client portal or managed file transfer for bundles and disclosure rather than personal file-sharing accounts, with expiry dates on external links. See the eDiscovery and Legal Hold Guide.
• Mobile and court working: managed devices with full-disk encryption and remote wipe; block local download of matter files to unmanaged devices through conditional access.
• Generative AI: approve specific tools, prefer enterprise terms that exclude training on prompts, and record client consent where Formal Opinion 512 or client guidelines require it. Block or monitor consumer AI sites for matter data: the Samsung ChatGPT source code leak shows how quickly well-meaning staff paste confidential material into a public tool. See the Shadow AI Policy Template.

Where identity fits

Almost every route in the threat table above runs through an account. Fee earner Microsoft 365 or Google accounts, the practice management system, the DMS, banking platforms and the managed service provider's remote management tool are the identities that matter most.

• Phishing-resistant MFA first for the riskiest roles: partners, the finance and accounts team, IT administrators and anyone who can approve client account payments. See the Phishing-Resistant MFA Guide.
• Separate admin accounts: the managed service provider and in-house IT should use named admin accounts with MFA, not a shared "itadmin" logon, and never their daily mailbox account.
• Leavers on the day: fee earners who move firms take relationships with them; disable accounts, revoke sessions and remove DMS and portal access on the last day, as the NCSC report recommends.
• Integration credentials: practice management, billing and e-signature integrations use API keys and OAuth grants that bypass MFA. Inventory them and rotate them when a supplier relationship ends. See the Third-Party Access Guide.

Implementation roadmap

1. Weeks 1 to 4, stop the money loss: written payment verification procedure with call-back and dual authorisation; bank details statement in client care letters; block external auto-forwarding; alerts on new inbox rules.
2. Weeks 2 to 8, close the front door: MFA on all email, remote access and DMS logons, starting with finance and IT; disable legacy authentication; patch internet-facing systems to a defined service level (for example, critical fixes within 14 days, as Cyber Essentials requires for high and critical updates).
3. Weeks 4 to 12, make recovery possible: at least one backup copy offline or immutable and outside the domain's admin accounts; restore the DMS and practice management system in a test and time it.
4. Months 3 to 6, assure the baseline: Cyber Essentials, then Cyber Essentials Plus for an independent technical check; supplier assurance questions for the IT provider and practice software vendors.
5. Months 4 to 9, matter data: DMS permissions by matter, information barriers in collaboration tools, retention enforcement on archives, encryption at rest.
6. Ongoing, rehearse: a tabletop each year on payment diversion and on ransomware with data theft, including the SRA, ICO and client notification decisions, using a resource such as the NCSC's Exercise in a Box.

Testing and rollback: roll MFA and conditional access out in report-only mode first, then to IT, then finance, then a pilot practice group, before all fee earners. Keep two tested break-glass accounts excluded from conditional access so a misconfigured policy can be reverted. For DMARC, run p=none with reporting for several weeks and fix legitimate senders (billing, marketing, e-signature) before tightening.

Decision guidance: small practice versus large firm

The deciding factor is often not size but the work: a two-partner conveyancing practice faces more payment diversion risk than a large firm's advisory team, while a firm acting on government or defence matters faces state actors whatever its headcount.

Detection and measurement

Log and alert on: new inbox rules and forwarding, sign-ins from new countries or anonymising infrastructure, new MFA methods registered, mass downloads from the DMS or file shares, new OAuth consents to mailbox data, and changes to banking payees. Keep Microsoft 365 or Google audit logs for at least a year so a mailbox compromise can be scoped back to its start.

• Payment verification rate: share of payee changes with a recorded call-back (target 100%).
• MFA coverage: percentage of accounts with MFA, and of finance and admin accounts with phishing-resistant methods.
• Patch latency: median days to patch critical vulnerabilities on internet-facing systems.
• Phishing report rate: share of simulated and real phishing reported by staff, and time to first report.
• Restore time: measured time to restore the DMS and practice management system from backup in the last test.
• DMARC enforcement: number of firm domains at p=reject.

Framework mapping

Common failure patterns

• Trusting the email thread. Bank details changed mid-transaction are paid because the message sat in a genuine thread; the thread was genuine because the mailbox was compromised. Only an out-of-band call-back breaks this.
• MFA everywhere except remote access. Tuckers had no MFA on its remote access solution, which the ICO called a comparably low-cost measure the firm should have implemented. Gateways and legacy VPNs are often the exception nobody revisits.
• Backups reachable by the attacker. The NCSC report notes that at Tuckers ransomware encrypted backups as well as case data. Backups joined to the same domain, with the same admin credentials, are not a recovery plan.
• Patching on a quarterly cycle. A fix released in January 2020 and applied at Tuckers in June 2020 was described by the ICO as a significant deficiency. Internet-facing systems need a service level measured in days.
• Assuming the IT provider covers security. The SRA describes compromises at an IT provider that spread to several firms. Without a written split of responsibilities, monitoring, patching and backup testing fall between the firm and the provider. See the Cybersecurity for MSPs and MSSPs Guide.
• Keeping everything forever. Archives of closed matters multiply the impact of a breach and the notification burden. Retention schedules that are written but not enforced give no protection.

Practitioner checklist

• Write and enforce a payment verification procedure: call-back on a known number for any changed bank details, dual authorisation, and a bank details statement in client care letters.
• Enable MFA on every email, remote access, DMS and banking login, with phishing-resistant methods for finance, partners and administrators.
• Block external auto-forwarding and alert on new inbox rules, new MFA methods and new OAuth consents.
• Publish SPF, DKIM and DMARC on all firm domains and move to p=reject; monitor for lookalike domains.
• Keep at least one offline or immutable backup outside the production admin domain and time a full DMS restore at least yearly.
• Patch internet-facing systems within 14 days for critical and high fixes, and retire unsupported remote access gateways.
• Restrict DMS access by matter, enforce information barriers in collaboration tools and apply retention schedules to archives.
• Agree a written responsibility split with the IT provider and assess key suppliers and chambers with security questions in contracts.
• Name owners for ICO, SRA, client, insurer and police notifications and rehearse them in an annual tabletop.
• Approve generative AI tools explicitly and record client consent where professional rules or client terms require it.

Standards and references

• NCSC: Cyber Threat Report: UK Legal Sector
• Solicitors Regulation Authority: Risk Outlook report, Information security and cybercrime in a new normal
• NCSC: Cyber Essentials overview
• American Bar Association: Generative AI for Lawyers, Part 2, Maintaining Confidentiality
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Financial Theft
• Legal Futures: Top criminal law firm fined £98,000 for cyber-security negligence

Related NHI Mgmt Group resources: Law Firm Identity and Data Security Guide · Business Email Compromise Response Playbook · Cyber Essentials Guide · Cybersecurity for Charities and Non-Profits Guide · Ransomware Response and Recovery Guide