Cyber Security for Law Firms: 2025 Threat Landscape and Defences

Law firms are among the most targeted organisations in the UK for cyber attack. They hold concentrated, high-value data — client confidences, transaction details, litigation strategy, property ownership records, personal financial information — and they typically have weaker security controls than the banks, insurers, and corporations whose confidential matters they handle.

The National Cyber Security Centre (NCSC) reported in 2024 that the legal sector was one of the five most targeted UK sectors for ransomware, and that the average cost of a ransomware incident at a UK law firm was £475,000 — a figure that does not include the regulatory consequences, client loss, and reputational damage that follow a publicised breach.

This guide covers the current threat landscape, the specific obligations the SRA imposes on firms, and the practical defences that matter most.

The 2025 Threat Landscape

Ransomware: The Primary Threat

Ransomware — malicious software that encrypts a firm’s data and demands payment for the decryption key — remains the single most destructive cyber threat facing UK law firms. The attacks have evolved significantly from the early, opportunistic ransomware of the 2010s:

Double extortion is now standard: attackers encrypt your data and also exfiltrate a copy before encrypting it. If you refuse to pay the ransom, they threaten to publish client confidential information publicly or sell it to counterparties in your clients’ transactions. For law firms, this threat is particularly acute — a solicitor whose client’s M&A strategy or litigation position is published by attackers faces consequences far beyond the technical incident.

Living off the land attacks use legitimate administrative tools (PowerShell, Windows Management Instrumentation) rather than obvious malware, making them harder to detect with traditional antivirus. Attackers enter through a phishing email or unpatched vulnerability, then spend weeks moving through the network quietly — accessing email, understanding the network topology, identifying high-value data stores — before deploying the ransomware.

Supply chain compromise: several high-profile incidents have involved attackers compromising a software vendor used by multiple law firms, then using that vendor’s trusted position to deliver malware. The 2023 attack on a UK managed IT service provider affected over 40 of its law firm clients simultaneously.

Business Email Compromise (BEC)

Business email compromise — where attackers intercept or impersonate email communications to redirect payments — is the cyber threat that law firms report most frequently to the Solicitors Disciplinary Tribunal. The mechanism is straightforward:

Attacker gains access to a solicitor’s email account (via phishing, credential stuffing, or a compromised email server)
Attacker monitors email communications until a property transaction or other payment is identified
Shortly before completion, the attacker sends the client — impersonating their solicitor — with changed bank details for the purchase funds
Client transfers funds to the attacker’s account
The real completion deadline passes; the fraud is discovered

Losses in conveyancing BEC fraud routinely run to hundreds of thousands of pounds per incident. The Legal Services Mutual Insurer has noted a significant increase in BEC claims over 2023–24, with several cases where the full sum was not recovered.

Phishing and Credential Harvesting

Phishing remains the entry point for over 80% of successful cyber attacks on professional services firms, according to the NCSC. The quality of phishing emails targeting law firms has improved substantially — AI-generated phishing emails now routinely avoid the grammatical errors and implausible premises that made early phishing easy to identify.

Spear-phishing — targeted phishing that references specific matters, personnel, or firm activities — is increasingly common against law firms. An email to a conveyancer referencing a specific property transaction by address, seemingly from a mortgage broker they work with regularly, is far harder to identify as fraudulent than a generic “your account has been suspended” message.

Insider Threats

The insider threat — current or former staff members misusing their access to client data — is underreported in the legal sector but material. Law firms typically have inadequate access controls: fee earners can access all matters regardless of whether they are assigned to them; support staff can read financial records without business need; former staff members’ accounts are not always disabled promptly.

The most common insider threat scenarios in UK law firms are:

A fee earner leaving to join a competitor and taking client matter data (confidential documents, contact records, matter history) with them
A disgruntled accounts employee accessing and manipulating billing records
Support staff accessing client confidential information out of curiosity and subsequently sharing it

SRA Obligations and the Regulatory Consequences of Breach

The SRA’s Position on Cyber Security

The SRA has made clear that cyber security is a compliance obligation, not merely a risk management question. The SRA Standards and Regulations 2019 require firms to:

Identify, monitor, and manage risks to clients (including the risk of cyber attack leading to client data breach or loss of client funds)
Have appropriate governance structures and controls in place
Protect client money and ensure it is not at risk from firm-level failures

Following a 2024 supervisory exercise covering 60 UK law firms, the SRA reported that 40% had inadequate cyber incident response plans, and that a third had not conducted any form of cyber security assessment in the previous two years.

Regulatory consequences of a significant cyber incident — particularly one involving client money loss or client data disclosure — can include:

Intervention: the SRA can close the firm and take control of its files and client account if the incident creates risk to clients
Fines: up to £25,000 per principal for authorised firms; unlimited for the entity
Referral to the Solicitors Disciplinary Tribunal
Mandatory notification to clients affected by the breach
ICO investigation and potential GDPR fine (up to 4% of annual global turnover for the most serious breaches)

The UK GDPR, as retained post-Brexit, requires law firms to report personal data breaches to the ICO within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals. Almost all cyber attacks involving client data will trigger this obligation.

The ICO has enforcement powers to fine UK GDPR violators up to £17.5 million or 4% of annual global turnover, whichever is higher. In practice, ICO fines in the legal sector have been proportionate to the firm’s size and the seriousness of the breach, but even a five-figure ICO fine accompanies significant reputational damage.

The Defences That Matter Most

Multi-Factor Authentication: Non-Negotiable

Multi-factor authentication (MFA) — requiring a second proof of identity (a code from an authenticator app, a hardware token, or a SMS code) in addition to a password — is the single most effective control against the most common attack vectors. An attacker who obtains a fee earner’s password through phishing cannot access the account without also compromising the second factor.

The NCSC’s advice is unambiguous: MFA should be mandatory for all systems that hold sensitive data or client money, including email, practice management systems, cloud storage, and remote access tools. This is not a technical nicety — it is the minimum baseline that a well-regulated firm should have in place.

Implementation note: SMS-based MFA is better than no MFA but is weaker than authenticator apps (such as Microsoft Authenticator or Google Authenticator), which are themselves weaker than hardware tokens (such as YubiKey). For fee earners with access to client account or to particularly sensitive client matters, authenticator apps are the appropriate minimum; hardware tokens for accounts staff and partners with financial authority.

Email Security: DMARC, DKIM, SPF

Email is both the most common entry point for attacks and the channel through which BEC fraud is perpetrated. Three technical controls — which are relatively straightforward to implement — dramatically reduce email-based risk:

SPF (Sender Policy Framework): tells receiving email servers which IP addresses are authorised to send email from your domain. This prevents trivial spoofing of your firm’s email address.

DKIM (DomainKeys Identified Mail): digitally signs outgoing email, allowing receiving servers to verify that the email has not been modified in transit and genuinely originated from your domain.

DMARC (Domain-based Message Authentication, Reporting and Conformance): tells receiving servers what to do with email that fails SPF or DKIM checks — reject it, quarantine it, or deliver it — and provides the firm with reports on email authentication failures.

Law firms that have not configured DMARC at “reject” policy are making it trivially easy for attackers to send clients emails that appear to come from the firm’s domain. Configure SPF, DKIM, and DMARC as a priority.

Endpoint Detection and Response (EDR)

Traditional antivirus software that relies on signature matching is ineffective against modern ransomware, which is typically bespoke per attack and has no known signature. Endpoint Detection and Response (EDR) tools — Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne — use behavioural analysis to detect malicious activity in real time.

For a firm with 10+ workstations and Windows-based infrastructure, Microsoft Defender for Business (included in Microsoft 365 Business Premium, which most law firms should already have) provides adequate EDR capability. Larger firms should consider a dedicated third-party EDR solution with a managed detection and response (MDR) service that provides human expert monitoring.

Backups: The 3-2-1 Rule

A functioning backup is the only reliable recovery mechanism for a ransomware attack that encrypts your production data. The standard backup approach is the 3-2-1 rule:

3 copies of your data
2 different storage media (for example, local disk and cloud storage)
1 offsite copy (geographically separated from your primary site)

Critically, backups must be air-gapped or immutable — that is, the backup copy must not be reachable from your main network. Ransomware routinely encrypts connected backup drives as well as primary data. An Azure Immutable Blob Storage backup, or a cloud backup service with immutability enabled (Veeam Backup, Datto, Acronis), cannot be encrypted by ransomware that has compromised your network.

Test your backups. A backup that has not been tested is not a backup — it is a hope. Run a recovery test quarterly, and document the recovery time achieved. Your business continuity plan should specify the maximum tolerable downtime and confirm that your backup/recovery approach meets it.

Staff Training and Phishing Simulation

Technical controls are undermined by staff who click phishing links or respond to social engineering. Regular security awareness training — and specifically simulated phishing exercises, where the IT team or an external security vendor sends realistic phishing emails to staff and tracks who clicks — is the most effective way to build a security-aware culture.

The NCSC’s Cyber Essentials scheme, which law firms of any size can certify against, provides a useful baseline framework and signal to insurers and clients that basic security controls are in place. Cyber Essentials Plus (which includes independent verification) is worth pursuing for any firm handling significant client funds or particularly sensitive matters.

Incident Response Planning

Despite best efforts, incidents happen. Firms that recover quickly and limit the damage are those that have thought through their response in advance. At minimum, your incident response plan should specify:

Who decides whether an incident is a “cyber incident” requiring formal response (typically the COLP or a designated IT lead)
The 72-hour ICO notification obligation and who is responsible for making it
The SRA notification requirement (reportable if there is or may be a risk to client money or data)
The client notification obligation (when must affected clients be told, and who drafts the communication?)
The external forensics and incident response provider you will engage (identify one in advance; negotiating a contract during an active ransomware incident is a bad position to be in)

The administrative infrastructure of a law firm — email, matter documentation, client communication — is both the most valuable target for attackers and the area where human error most commonly creates vulnerability. Obiter’s AI-driven approach to client communication, which routes incoming email through a supervised drafting process, reduces the risk of fee earner-level phishing errors while also capturing billable time and managing matter workflow. Secure by design and compliant with UK data protection law, Obiter helps firms manage the communication layer that attackers most commonly exploit. Learn more at obiteros.com.