Law firms and supply chains carry increased risk of cyberattack, says SecurityHQ

Law firms carry an “elevated risk” of cyber threats, according to managed service security provider SecurityHQ, after a recent industry study found 75% of UK practices had been the subject of a cyberattack. SecurityHQ said law firms’ access to confidential client data and the potential for financial gain make the sector a prime target for cyberattacks, but it added that “security is not often at the top of the priority list”. “Legal practices hold a wealth of data that can be exfiltrated,” SecurityHQ said. “Lawyers can’t afford to lose a single note on a case, so if data is stolen, they are more likely to pay the ransom or meet the demands of the threat group/attacker, as they have a lot to risk if the data is leaked,” it said, adding that most attacks are driven by money. “Financial gain is at the heart of most attacks directed within the industry, with infiltration made via supply chain attack and ransomware/phishing attacks,” it said. Law firms’ supply chains can be compromised through exploitation of third-party stores, case management systems or software providers. Last week, the Solicitors Regulation Authority (SRA) in the UK published its Risk Outlook Report, which reveals that 75% of 40 firms investigated were the victims of a cyberattack, exposing client money and data. SecurityHQ said the SRA’s disclosure of the scale of cyberattacks against law firms is “made worse” by the finding that half of law firms allowed unrestricted use of external data storage. Since 2017, when DLA Piper and several other law firms were hit by a ransomware attack, the sector has been a target for cyberattacks, which have become more sophisticated. Last year, Campbell Conroy & O’Neil was left unable to access client files after it was targeted in a ransomware attack. “This just emphasises the need for proactive, rather than reactive, threat hunting. To spot and stop threats before it is too late,” SecurityHQ said. Conventional security tools will only detect known cyber threats and are blind to new strains of ransomware. Moreover, ransomware is often downloaded in phishing emails. Following the SRA’s finding that four out of five cyberattacks involved email, SecurityHQ advised law firms to be vigilant when opening messages and warned against opening attachments from unknown senders, suggesting users should hover over attachments to check for a real link and do not fall for emails labelled ‘urgent’. “Email remains a significant vulnerability for law firms,” the SRA said, which found 83% of cybercrime reported by law firms in 2021 involved email, driven by phishing. Paul Philip, chief executive of the SRA, said: “Law firms are targeted by cybercriminals as they often hold large amounts of client money and/or sensitive information. It is in everyone's interest that firms take all reasonable steps to protect themselves and their clients, all the more so as innovation and increased use of IT make information security a priority. “Protection isn't just about software. Having the right systems in place, such as antivirus software or multifactor identification, really matters. But good training and a culture in relation to managing risks is just as important,” he said.

Law firms and supply chains carry increased risk of cyberattack, says SecurityHQ

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Related Articles