TL;DR:

  • Law firms face a specific threat profile: mandate fraud (client money redirection), ransomware targeting client files, and data exfiltration of privileged communications
  • The SRA Code of Conduct for Firms requires firms to protect client confidentiality and have appropriate systems — a cyber breach can attract regulatory investigation and disciplinary action
  • ICO enforcement in the legal sector is real: multiple firms have received fines for poor data security following breaches
  • Core controls for most UK law firms: email authentication (DMARC/DKIM/SPF), multi-factor authentication on all systems, a verified bank detail change procedure, encrypted client portals, and staff training that specifically covers mandate fraud

Law firms are not typical small businesses from a security perspective. Even a high street firm of five solicitors handles client money, confidential documents that could affect significant financial transactions, and communications that carry legal privilege. That combination makes the sector a consistent ransomware target and the primary hunting ground for mandate fraud gangs.

This guide is written for fee earners and practice managers at small to mid-sized UK firms, not security specialists. It covers what the SRA expects, what the most damaging attacks look like, and the practical controls worth investing in.

Your Regulatory Exposure

SRA Code of Conduct

The SRA Code of Conduct for Firms (Chapter 4 of the Standards and Regulations) requires firms to protect client money and assets, maintain confidentiality, and have “effective governance structures, arrangements, systems and controls” in place. There’s no explicit list of cybersecurity controls in the Code, but the SRA has made clear — including in its warning notices and enforcement decisions — that a firm that suffers a preventable cyber attack may have breached these obligations.

The SRA also maintains a Warning Notice on cybercrime specifically addressing email modification fraud (mandate fraud). Firms that haven’t taken reasonable steps to verify bank detail changes are at increased risk of regulatory action if client money is redirected.

ICO and UK GDPR

Law firms process special category data and highly sensitive client information. Under UK GDPR, you must implement “appropriate technical and organisational measures” to secure personal data. Ransomware attacks and data breaches must be reported to the ICO within 72 hours if they involve personal data and are likely to result in a risk to individuals.

The ICO has fined legal sector organisations for inadequate security following ransomware attacks and data breaches. The fines for small firms under current ICO enforcement tend to be lower than headline GDPR maximums, but enforcement also includes enforcement notices requiring specified remedial action, and reputational damage from a published ICO decision is significant in a sector built on client trust.

Professional indemnity and cyber insurance

Most firms’ PI insurance doesn’t cover cyber attacks as a primary cover. Dedicated cyber insurance is a separate product and is worth reviewing if you don’t have it. Check what your policy requires for qualification — many policies now mandate MFA across your email and key systems as a minimum.

The Attacks That Hit Law Firms

Mandate fraud (bank detail change fraud)

This is the most damaging attack specific to the legal sector. The pattern:

  1. An attacker compromises either your email account or a client’s email account
  2. At a moment when a significant financial transaction is completing (property sale, business acquisition, settlement payment), an email is sent changing the bank details to be used for the transfer
  3. The change looks authentic — it comes from a familiar address or uses a lookalike domain — and the recipient processes it
  4. Client money is transferred to the attacker’s mule account, typically cleared internationally within hours

The Solicitors Regulation Authority has logged thousands of mandate fraud incidents resulting in millions of pounds of client money losses. In some cases the firm had to make good the loss from client account — in others, where negligence was found, regulatory and civil liability followed.

The single most important control: a verbal verification procedure for any bank detail change. Call the person who sent the change request on a number you already have (not one provided in the email). Confirm verbally. Document that you did. Train every person who handles completions or financial transactions.

Ransomware

Law firms are ransomware targets because their files have high value to clients and because firms often can’t afford operational disruption during litigation timelines or active transaction timelines. The operational pressure to pay is higher than in many businesses.

Ransomware typically enters via:

  • Phishing emails with malicious attachments or links (by far the most common)
  • Compromised remote desktop (RDP) exposed to the internet
  • Exploitation of unpatched software on internet-facing systems
  • Compromised staff credentials used to access cloud systems

A ransomware attack on a case management system like Osprey, LEAP, or Clio can be catastrophic if there’s no air-gapped backup. Many firms back up to a cloud location that’s connected to the same accounts the attacker has already compromised — meaning the backup is encrypted too.

Phishing and email account compromise

Solicitors receive a high volume of urgent, high-value emails from clients, courts, opposing solicitors, and financial institutions. This makes them good phishing targets — a well-crafted phishing email fits the normal noise of an inbox and urgency reduces scrutiny.

Email account compromise (a hacker accessing your email account, often via a stolen password or a successful phishing attack) is the precursor to mandate fraud. An attacker in your email account can read pending transactions, understand timing, monitor for completion dates, and trigger a bank change request at the optimal moment.

Core Security Controls for Small to Mid-Sized Firms

1. Multi-factor authentication, everywhere

Every account that can be used to access client data, client money systems, or email must have MFA enabled. Priority order:

  • Microsoft 365 or Google Workspace (your email)
  • Case management software
  • Client portals
  • Accounts with access to client money
  • Remote access (VPN, RDP)

Use an authenticator app (Microsoft Authenticator, Google Authenticator) rather than SMS for MFA wherever possible. SMS-based MFA can be bypassed by SIM-swapping attacks, which are increasingly common.

2. Email authentication: DMARC, DKIM, SPF

These three email authentication protocols protect your domain from being spoofed. Without them, attackers can send emails that appear to come from your domain.

  • SPF — declares which mail servers are authorised to send email on behalf of your domain
  • DKIM — adds a cryptographic signature to outbound emails that recipients can verify
  • DMARC — tells receiving mail servers what to do with emails that fail SPF/DKIM checks (quarantine or reject)

Without DMARC on reject policy, attackers can send emails to your clients that appear to come from partner@yourfirm.co.uk. This is the sender spoofing technique used in mandate fraud.

Setting this up requires DNS access. Your IT provider or managed service provider should handle the configuration. Check your current DMARC status at mxtoolbox.com — search for “DMARC” followed by your domain.

3. Verified bank detail change procedure

Write a policy and train every person who handles completions and payments:

  1. Any request to change bank details must be verified by telephone before acting
  2. Call the requesting party on a number already in your records — not a number in the email
  3. Document the verification with time, who you spoke to, and the number used
  4. Never process a bank change based solely on an email instruction

This should be in your firm’s risk management policy and your client care letters should mention it. Some firms add a line to completion notifications: “Our bank details will not change. If you receive any communication changing our bank details, please call us immediately to verify.”

4. Backup that isn’t connected to your main systems

Your backup needs to be restorable even if your primary systems — including the accounts that access your main cloud storage — are compromised.

Options in practice:

  • Encrypted daily backup to external hard drives rotated offsite (simple, manual, effective)
  • Immutable cloud backup (Backblaze B2, Azure Immutable Blob Storage, Veeam Immutable backup) — backup data that cannot be deleted or overwritten by a compromised account
  • Managed backup via your case management vendor (some provide offline/immutable options)

Test restoration. A backup you’ve never restored from is an assumption, not a safety net.

5. Password manager and strong passwords

Require a password manager (Bitwarden, 1Password, or Microsoft’s built-in password manager via Edge) for all staff. This eliminates password reuse — the single most common reason compromised credentials from a breach on one site lead to account takeover somewhere else.

Minimum password requirements are less important than ensuring staff don’t reuse passwords across work and personal accounts. Password managers solve this problem.

6. Patching

Keep Windows, Office 365 apps, and case management software current. Most ransomware exploits known vulnerabilities with available patches. If you have a managed IT provider, confirm they’re applying patches on a defined schedule and confirm the case management software is included.

7. Client portal for sensitive documents

Sharing sensitive documents, draft contracts, and ID verification materials by email is standard practice but poor security. Email is not encrypted in transit by default, attachments can be forwarded beyond intended recipients, and attachments don’t expire.

Secure client portals (available in most current case management systems, or as standalone services like HighQ, Citrix ShareFile, or firm-specific solutions) give documents an access-controlled home that you can audit and revoke.

For high-value transactions and AML due diligence materials, moving this off email significantly reduces exposure.

SRA Reporting Obligations

The SRA expects firms to report “any serious breaches of our regulatory requirements.” A data breach that involves client money, privileged information, or a significant failure of confidentiality meets this threshold. Firms should consider whether to report to:

  • ICO — mandatory within 72 hours if the breach involves personal data and is likely to result in risk to individuals
  • SRA — required where the breach constitutes a serious regulatory breach; this includes significant loss of client confidentiality
  • National Cyber Security Centre (NCSC) — reporting encouraged (though not mandatory for most firms); NCSC provides free incident response guidance
  • Action Fraud — if financial loss has occurred; police reference number useful for insurance claims

The Law Society’s Cybersecurity Guidance

The Law Society has published a cybersecurity guide for law firms with practical controls aligned to what the SRA expects. It covers risk assessment, staff training, supplier management, and incident response. It’s free and written for practice managers rather than technical teams. Worth downloading from lawsociety.org.uk and using as the basis for a firm-wide security review.

Cyber Essentials certification (the government-backed baseline security standard) is also worth considering for firms that want a recognised baseline and some assurance for clients on government contracts.

If You’re Hit

If you suspect a breach:

  1. Don’t panic and don’t immediately wipe systems — you need logs for investigation and evidence for insurance claims
  2. Disconnect affected systems from the network — stop the spread, but preserve the state for forensics
  3. Call your IT provider or managed security provider immediately
  4. Notify your PII insurer — your policy may require notification within a specific timeframe; late notification can void cover
  5. Preserve evidence of what happened — screenshots, email headers, timeline of events
  6. Consider your notification obligations to ICO, SRA, and affected clients
  7. Do not pay a ransom without taking specialist advice — your insurer and legal counsel should be involved in that decision

References