Professional services businesses — law firms, accountancy practices, management consultancies — are disproportionately targeted by cybercriminals for a simple reason: they hold extremely high-value data (client financials, legal strategies, M&A information, personal data under various pieces of legislation) combined with the trust relationships that make social engineering straightforward. If an attacker compromises a law firm’s email, they have access to correspondence that opens doors to the firm’s clients, counterparties, and regulators.
The sector-specific threat is real. The NCSC’s annual reports consistently show that legal and professional services are among the UK industries most frequently targeted by ransomware groups and business email compromise (BEC) operations. The SRA (Solicitors Regulation Authority) received hundreds of reports of successful cyber attacks on law firms in the past two years alone, many involving client money being redirected.
The Regulatory Dimension
Professional services firms have compliance obligations that go beyond the general UK GDPR baseline.
Law firms are regulated by the SRA (in England and Wales), the Law Society of Scotland, or the Bar Standards Board. The SRA Accounts Rules require firms to protect client money with reasonable security controls, and the SRA’s Technology and Innovation Strategy explicitly addresses cybersecurity expectations. The SRA can investigate and sanction firms where inadequate security resulted in client money being stolen or confidential information being compromised. It’s not just a regulatory fine at stake — the SRA can restrict a firm’s right to practise.
Accountancy practices regulated by ICAEW, ACCA, or CIMA have duties under their respective codes of ethics to protect client confidentiality, which extends to protecting systems that hold client financial data. The FCA’s Senior Managers and Certification Regime (SMCR) applies to regulated financial advisers and places personal accountability on senior managers for operational resilience, including cyber resilience.
Management consultants don’t have a single professional regulator in the same way, but they’re subject to UK GDPR for personal data, often have contractual obligations to clients that include data security requirements, and may fall under the Network and Information Systems (NIS) Regulations if they provide certain digital infrastructure services.
Cyber Essentials certification is increasingly required by government contract frameworks and by clients who have their own supply chain security requirements. If your firm bids for public sector work, Cyber Essentials is often mandatory. It’s a reasonable baseline to achieve regardless.
The Most Common Attack Vectors
Business email compromise is the single biggest financial threat to professional services firms. The attack pattern: compromise a firm’s email account (usually via credential phishing or a weak password), monitor correspondence to understand ongoing transactions, then at a critical moment send a fraudulent email to a client or counterparty redirecting payment. In conveyancing, this has led to buyers transferring their property purchase funds to criminal accounts. The SRA and UK Finance publish regular warnings about this.
Defending against BEC requires a combination of technical controls and client-facing processes. On the technical side: multi-factor authentication on email (the single most important control), DMARC/DKIM/SPF properly configured to prevent spoofing of your domain, and email filtering that flags messages from look-alike domains. On the process side: a firm and well-communicated policy that bank details will never be changed by email, and that any change of payment details should be verified by phone on a number independently verified, not one provided in the same email.
Ransomware targeting professional services typically comes via phishing, exposed RDP, or vulnerable software on internet-facing systems. Law firms are valuable ransomware targets because: they hold privileged communications, their regulatory obligations create pressure to restore quickly, and they can’t simply refuse to pay and accept data loss the way some industries can when client-privileged information is at stake.
Supply chain attacks via compromised practice management software, legal technology platforms, or cloud document systems are an emerging concern. When your matter management software is compromised at the vendor level, even your internal security controls don’t protect you. Vendors should be assessed for their security posture before you integrate them with client data systems.
Practical Controls for Smaller Firms
For a firm of 10-50 people without a dedicated IT security function, the priority list looks like this:
Multi-factor authentication, everywhere. Microsoft 365 and Google Workspace both support MFA — enable it for all accounts, including admin accounts (which need hardware security keys, not just authenticator apps). This alone stops most credential-based account compromises.
Email security configuration. DMARC in enforcement mode (p=reject) prevents criminals from sending email that appears to come from your domain to your clients. DKIM and SPF are the underlying building blocks. Your DNS admin or IT support can configure these in an afternoon. Check your current configuration at DMARC Analyser or MXToolbox.
Client communication protocols. Embed a standard footer in your email signature reminding clients that you will never request a change of payment details by email. Train your team on this. Make it part of your client onboarding documentation.
Encryption for sensitive documents. Don’t send draft contracts, financial statements, or personal data as unencrypted email attachments. Use your practice management system’s secure portal or a reputable encrypted file sharing service. NetDocuments, iManage, and Clio all have client-facing portal features.
Endpoint security. Microsoft Defender (included with Microsoft 365 Business Premium) is entirely adequate for most small professional services firms. Turn it on, ensure automatic updates are enabled, and confirm that Defender for Business is configured with basic attack surface reduction rules. Business Premium also includes Intune for device management.
Regular backup and tested restoration. Ransomware recovery depends on having offline or immutable backups. Microsoft 365 backup through a third-party tool (Veeam, Acronis, or similar) protects your email and SharePoint. On-premises servers need separate backup solutions with offsite copies. Test your restoration process at least annually — many firms discover their backups don’t work when they need them.
Staff awareness. The NCSC’s free e-learning modules (Top Tips for Staff, accessible via the NCSC website) take 30 minutes and cover the basics. Action Fraud’s Take Five campaign materials are also useful for phishing awareness. Run a simple phishing simulation annually — several managed IT providers offer this as part of their package.
When You Need More Than the Basics
If your firm handles sensitive M&A work, government contracts, financial crime matters, or regulated client assets, the basic controls above are necessary but not sufficient.
Consider cyber insurance with a specialist broker who understands professional services. Hiscox, CFC, and Beazley all offer products tailored to law and professional services firms. Be honest on the application — insurers are increasingly scrutinising security controls, and misrepresentation on an application can invalidate a claim.
A penetration test by a CHECK or CREST-certified provider gives you an independent view of your real attack surface. The SRA has encouraged firms handling significant client money to conduct regular penetration testing. For firms of 20 or more staff, this is a worthwhile annual or biennial exercise.
For incident response, know in advance who you’ll call if something goes wrong. Your IT support provider may not have incident response capability. Specialist firms like Secureworks, Mandiant (now part of Google), or UK-based IR providers can respond quickly. Having a retainer in place before you need it avoids the paralysis of having to find and onboard a supplier in the middle of a crisis.