Why Cybercriminals are Targeting Solicitors

Posted by Tom Breza on July 14, 2021

Judge gavel with scale of justice, documents on the table in the courtroom to support an article entitled Why Cybercriminals are Targeting Solicitors

The growing threat of cybercrime has become an ever-present concern for businesses, and solicitors are no exception. As technology advances, the risks posed by malicious actors also increase. This is placing a strain on IT support teams to protect their clients from data, and other online, threats. With recent studies conducted by Action Fraud showing that 75% of firms have experienced successful attacks in the past three years, it is more important than ever to understand the nature of these crimes and how best to defend against them.

In this blog post, we will explore the various types of cyberattacks that target law firms as well as discuss some key cybersecurity measures that can help mitigate potential damages.

From an Anatomy of Crypto-Enabled Cybercrimes

From the report created by Lin William Cong, Campbell R. Harvey, Daniel Rabetti and Zong-Yu Wu we can take the following insights:

20% of firms had never provided specific cybersecurity training to their staff. More than half did not keep records of who had received such training. Most firms implemented appropriate mitigation measures and the remainder were still implementing new processes and controls.
93% of the firms had firewalls in place, with more than half having firewalls around both individual devices and a wider firewall around their overall systems. All firms undertook some form of backup exercise, while the majority (87%) were able to show they made active use of anti-virus software.
The firms that were part of the study ranged in size. The smallest were 1-4 partners with the largest having more than 25 partners.
In September 2019, Action Fraud reported an annual total of 43,717 referrals about fraud and cyber-crime.
67% of firms had produced disaster recovery plans. 47% had undergone penetration testing by an external party. 37% had taken internal steps to stress-test processes and procedures. 35% of firms had taken no steps to test or audit their processes and/or procedures.

As you can see from the above report not everything is perfect, there are certain steps businesses take to mitigate the risks of cybercrime such as business continuity but surprisingly 13% do not have antivirus software installed, which is one of the most basic and essential tools to combat malware and viruses. With further 20% never attempted to train their staff about cyber security.

What types of attacks are the biggest headaches for law firms?

Phishing Attacks:

These are typically carried out via email and designed to trick recipients into revealing information like usernames, passwords, or credit card details. The emails often appear as if they are from a legitimate source which the recipient trusts.

Ransomware Attacks:

In these attacks, cybercriminals infiltrate a network and encrypt the firm’s data, then demand a ransom in exchange for the decryption key. This can lead to substantial downtime and financial losses, not to mention potential damage to the firm’s reputation.

Data Breaches:

Whether through hacking, social engineering, or inside jobs. Breaches involve unauthorized access to confidential information. This can lead to loss of client trust, legal penalties, and other severe consequences.

Malware Attacks:

This includes viruses, worms, Trojans, and other malicious software that can damage systems, steal information, or create vulnerabilities for further exploits.

Here’s why Cybercriminals are Targeting Solicitors

Solicitors are responsible for providing legal advice, representing their clients in court proceedings, and drafting legal documents. However, law firms also have a unique responsibility to protect the confidential data of their clients. This includes any sensitive information that may be released during the course of a case or legal proceeding.

Solicitors by their nature have access to a lot of data that is confidential, such as business contracts, and documents about victims and vulnerable people.

Cybercriminals such as the defunct gang REvil had a very brutal approach. Once they managed to gain access to a company’s resources they would steal the data, encrypt it on local computers and servers and request ransom in order to release the data.

If the legal firm would not enter into negotiation intimidation techniques would be employed. From calls and emails advising the victim that not only they will lose the data but added that it will be made public. It is easy to imagine the damage to any legal business if such a breach occurred.

Duty of care

Legal firms have a duty of care to their customers and are very closely observed by the courts and regulators.

The legal industry is very highly regulated which in this case is a double-sided blade. On one side if there is a breach the customers of the law firm are shielded and the law firm must ensure that its data security is top-notch, which is difficult, especially for small law firms.

On the other side, legal firms can’t use a lack of resources or knowledge as an excuse for a lack of protection. For the legal firm, it is vital importance to have robust protection part of that is an infrastructure strategy.

Ways for solicitors to protect themselves

As you can see law firms are a prime target due to the nature of this type of business. For that reason, the legal sector has to pay a lot of attention to the security of client’s data.

Cyber Essentials and Beyond

It is highly recommended that the legal firm will obtain Cyber Essentials certification as this will make it easier to be in line with compliance and the long run provide a competitive advantage to such a firm.

ISO 27001

Many law firms should consider going even step further and considering ISO27001.

Getting both ISO 27001 and Cyber Essentials involves putting into places procedures and security processes that will significantly improve the IT security within the firm.

The next step

If your law firm is looking for an IT partner that can help you achieve higher security and compliance standards, look no further than Operum.Tech. Our team of IT experts are available for both remote and onsite support, as well as unlimited support packages. We also have the Drata.com platform that automates and simplifies the compliance process for you. Contact us today to get started.