Cyber Security Attacks & Data Breaches of Law Firms [Updated 2024]

Law firms stand as custodians of some of society's most sensitive information, entrusted with safeguarding client confidentiality, proprietary data, and legal strategies. However, as the reliance on digital technologies grows, so does the threat landscape surrounding these institutions.

Data breaches within law firms have become an increasingly prevalent and concerning issue, casting a shadow over the profession's integrity and raising critical questions about cybersecurity preparedness. Weaknesses in data security are often the result of poor, inappropriate, obsolete or untested systems, controls or training in relation to GDPR awareness or cybersecurity measures. 

At PDA Legal, we provide specialist cybersecurity audits, consultancy and training for the legal sector coupled with a range of GDPR services to support legal firms in protecting themselves and clients data from data breaches. It’s an unfortunate reality that we frequently identify or encounter gaps in security processes or controls which firms are unaware of (and even shocked by, once the vulnerability is brought to their attention).

Whilst most legal practices would agree data security and integrity are important when asked, when it comes to action, many still regard data security as somewhat of an after-thought or simply “...an IT issue…”; one where the simple installation anti-virus and/or firewall software assume that is all that is required to keep data safe.

So is that sufficient? What exactly is the degree of risk in the ‘real world’? When time-sensitive, revenue-generating work is mounting up, is there a sufficient business need to review security measures? 

In this article, we provide you with some of the most recent statistics relating to data breaches within the legal sector.

Recent Statistics - UK Law Firm Data Breaches

• A 2022 report by Cert-UK announced that 65% of UK law firms have been a victim of a cyber incident [1]
• Despite the previous statistic that outlines the need to protect ourselves, 35% of firms still do not have a cyber mitigation plan in place [2]
• The Law Society of England and Wales shows that seven in 10 (72%) of firms have not purchased cyber insurance [3]
• Whilst larger firms are more likely to engage third parties for a security assessment, the numbers are still low – 40% for firms of 50-99 lawyers and 53% for firms of 100-499 lawyers [4]
• Cyber threats are now a concern for 78% of the top 100 law firms in the UK [5]
• The number of reported cyber breaches at UK law firms jumped by 36% in 2022/23 as hackers increasingly target the profession [6]
• Over £4 million of client money was stolen from just 23 UK law firms who reported suffering a cyber attack [7]
• In 2021, a city law firm reported that they had lost client data as a result of a cyber-attack. It was reported that the market reacted swiftly, wiping off almost 8% share value within an hour of the statement [8]
• The SRA published 278 scam alerts in response to reports from the public and profession between January 2022 and January 2023. These scam alerts highlight reports of people falsely claiming to be solicitors and firms, for example on websites or in emails and telephone calls [9]
• Nearly three-quarters of the UK’s top 100 law firms have been affected by cyber attacks, and for smaller firms that have little or no dedicated cyber security and IT support, the risk of incidents like ransomware attacks is on the increase [10]
• 75% of surveyed UK law firms suffered a cyber attack in 2020 [11]
• Over 80% of all the cybercrime reports we received in 2021 involved email [12]
• The ICO can fine up to 4% of a company’s total annual worldwide turnover in the last financial year or £17.5 million, or whichever is higher, for negligent treatment of client data [13]

The Key Statistics - UK Businesses in General

Ultimately, law firms sit as a subset of other business types, so we have included some general UK cyber-security statistics to help compare the above with businesses in a wider context:

• 53% of all UK fraud is online, equating to 1.9 million offences [14]
• The Cyber Breaches Survey 2023 reported that of the 48% of UK businesses that identified an attack, the most common threat vector was phishing attempts (79%) [15]
• 32% of UK businesses reported suffering a cyber attack in 2022-23 [16]
• Nearly 75% of breaches occur due to employee actions – whether accidental (such as opening links from phishing emails) or deliberate (such as giving login information to hackers in return for money) [17]

Sources

• The Law Society [1], [2], [3], [9], [14]
• UK National Cyber Security Centre [8], [9], [10]
• GOV.UK [15]
• SRA.Org [12]
• AAG IT  [4], [5], [7], [11], [14], [17]
• Legal Futures (ICO) [6]
• ICO.Org [13]

We Are Here to Help you to Protect Your Firm From Data Breaches

At PDA Legal, we are committed to supporting your firm with supportive audits, consultancy and training to help maintain your team’s awareness in support of best practice and compliance with regulations regarding data protection. Our services are provided by industry experts, so please get in touch to book a FREE initial consultation today.