Law firms are under threat more than ever by cyber attacks, phishing attempts, scams, and data breaches. It’s essential that you know the risks imposed by cybercrime to protect your law firm and your clients’ personal information and funds.
In our recent webinar with DG Legal, Data Disasters and How to Prevent Them, we covered the best steps to take to avoid leaking sensitive data and avoiding hefty ICO fines. The topics covered included:
- The true cost of cyber attacks
- Common cyber attack methods
- Current cyber attack threats and how to protect your firm
During this webinar, Kate Burt, Head of Risk and Compliance at Legl, shared that phishing and email modification make up half of all cybercrime reported to the SRA.
The true cost of cyber attacks to law firms
39% of UK businesses identified a cyber attack in 2021-22.
The PwC Annual Law Firms Survey 2020 discovered that cyber risk is the second greatest threat to law firms meeting and/or exceeding their ambitions from 2020 to 2022.
Law firms are at risk from cyber attacks for a number of reasons. A combination of working with high value transactional work (such as conveyancing) and the nature of handling very sensitive client information places law firms under threat.
During this webinar, Louise Gibson, Detective Sergeant with Leicestershire Police, explained that the most common methods cyber criminals use include:
- Email modification
- Spyware
- Ransomware
- Viruses
- Denial of service attacks
- Gaining remote access to a firm’s systems to manipulate on the backend
During a cyber attack, the costs incurred are not just financial. David Gilmore, Director & Founder of DG Legal, stated that cybercrime also causes indirect losses in relation to your firm’s reputation, data loss and stress induced by the crime.
Real-world case study: Ransomware attack
In August 2020, an IT-savvy criminal law firm suffered a major data disaster and were fined almost £100,000 due to a ransomware attack.
Adam Makepeace, Consultant for DG Legal, explained that the firm’s case management system with all their live files and accounts were held in a cloud-based system protected by MFA. However, it was the firm’s legacy structure with on site servers that was the weak spot and allowed the cyber criminals to penetrate the system.
There was a vulnerability on one of the platforms, whereby the security patch wasn’t applied in the relevant period. By the time it was applied, the malware was already installed and lying dormant on the platform. This meant that the hackers could choose when to execute the file and start encrypting.
This tech-savvy firm thought they did everything that they could to protect themselves from cybercrime; it was just the late update that caused the system vulnerability and left them open to attack.
“Over 972,000 individual files were encrypted, containing sensitive information in court bundles. Not only that, but the business’s emails were frozen, causing severe business disruption.”
Current cyber threats and how to protect your business
Some of the most common threats today include:
Phishing
This type of social engineering influences users to disclose information or click a bad link. Phishing attacks are very targeted and increasingly hard to spot.
How to protect your business:
Check your social media footprint, as this information can be used to make phishing emails look more realistic. Phishing attacks usually take place via email, texts and phone calls.
Detective Sergeant Louise Gibson reiterated: “Your bank will never ask you to click anything in an email. It will always be via a secure online portal. And if it sounds too good to be true, it probably is.”
Ransomware
Ransomware is an act of gaining access to an organisation, making data unreadable and demanding sums of money for the release. 47% of UK businesses have been affected by ransomware attacks, a number which is on the rise.
How to protect your business:
Consider your business’s RDP (Remote Desktop Protocol). If it’s left open and insecure, it’s an easy way for cyber criminals to access and infiltrate your network.
What your law firm can do to prevent data breaches and protect your clients
Cloud-hosted software
Consider implementing cloud-based software that has stringent security features run on a secure environment, preferably hosted in a UK data centre. Cloud hosts automatically performs necessary updates with dedicated engineers on hand 24/7.
A system that takes care of the cybersecurity side of your business allows you to focus on delivering an exceptional legal service to your clients.
Internal training
Kate Burt shared information about how to establish a culture of privacy in your law firm:
- Lead by example
- Share learnings from near-misses and encourage openness
- Appoint data protection champions
- Implement tailored cybersecurity training
- Reinforce training with examples and regular reminders
- Consider data security frameworks such as ISO27001 and Cyber Essentials (Plus)
