The Rising Cyber Security Risks to the UK Legal Sector

Lawyers, legal practices, and law firms are integral to the nation’s economy and society, serving as pillars for justice, dispute resolution, and business transactions. Unfortunately, the sector’s importance also makes it an attractive target for cybercriminals due to the substantial amounts of money and sensitive information routinely handled.

The dynamics of the legal sector have evolved, especially accelerated by the COVID-19 pandemic, resulting in changing work patterns and an increased sophistication in cyber attacks. Recent incidents within the legal sector (Allen & Overy and CTS) have underscored the pressing need for a comprehensive understanding of the cybersecurity challenges at the highest levels of corporate governance.

 

 

Why are criminals targeting the UK legal sector?

The legal sector is highly vulnerable due to its handling of sensitive data, financial responsibilities, and authoritative roles. Law firms specialising in corporate or property law face even 

higher risks because of potential financial gains. Smaller law firms, in particular, are susceptible targets as they may lack the resources of larger counterparts but still handle significant funds. Moreover, these firms often operate with a lean team overseeing their entire business infrastructure, which limits their dedicated resources for IT security.

Contrary to common belief, cybersecurity is not solely the responsibility of the IT department. Every department shares accountability for cybersecurity. It is an integral part of comprehensive information risk management and requires active engagement and emphasis from business leaders.

 

Handling Highly Sensitive Client Information

Law firms play a crucial role in managing highly sensitive client information, such as details related to ongoing criminal cases or mergers and acquisitions. This information holds significant value for criminal organisations looking to exploit opportunities for insider trading, gain advantages in negotiations and litigation, or subvert the course of justice.

Vulnerability to Ransomware: Disruption and Extortion

The potential disruption to routine business operations poses a substantial financial threat to legal practices. This includes the loss of billable hours during outages and the financial impact on clients who rely on these services. Consequently, legal practices become appealing targets for ransomware gangs aiming to extort money in exchange for restoring essential IT services.

Significant Financial Transactions 

In various areas, from mergers and acquisitions to conveyancing, legal practices handle significant funds. The time pressures associated with transactions, coupled with the management of numerous suppliers, clients, and complex payrolls, create attractive conditions for phishing attacks and business email compromise.

Reliance on External IT Services

Many legal practices, especially smaller firms, chambers, and individual practitioners, heavily depend on external IT service providers. This reliance makes it challenging for them to independently assess whether the controls in place are appropriate for the risks they face. The vulnerability of small law firms to attacks, such as ransomware, is heightened by factors like unpatched vulnerabilities on unmanaged devices, inadequately trained staff, or poorly offboarded employees. Once attacked, even a relatively small financial or reputational loss may have disastrous consequences.

Reputation at Stake: The Appeal to Extortion

Reputation is critical to the business of law, making legal practices attractive targets for extortion. The importance of maintaining a positive reputation further underscores the need for robust cybersecurity measures and safeguards against potential threats.

 

Who is targeting the legal sector?

Cyber Criminals: Diverse Threat Landscape

The primary menace to the UK legal sector arises from cyber criminals motivated by financial gain. Ranging from sophisticated, professional groups to small-scale fraudsters, these criminals can easily access ‘off-the-shelf’ services from more experienced counterparts, expanding the scale of cyber crime. Automation and minimal technical knowledge drive indiscriminate attacks on organisations of all sizes. The emergence of ‘hackers-for-hire’ further amplifies the threat, as they execute malicious cyber activities on behalf of third-party clients, often involving information theft to gain advantages in business or legal disputes.

Nation States: Strategic Cyber Activities

Nation states engage in cyber activities to advance their national interests, disrupt dissenting professionals, or address issues like human rights and regime change. Russia, Iran, and North Korea leverage criminal actors for state purposes, using criminal malware techniques for fundraising and causing disruption. Major law firms, integrated into wider supply chains, face heightened exposure. State actors, such as China, may target law firms dealing with sensitive clients or operating in hostile locations, posing additional risks, including intellectual property theft.

Hacktivists: Motivated by Causes

Hacktivists, driven by specific causes or agendas, employ cyber attacks to further political or personal motives. Noteworthy is the use of Distributed Denial of Service (DDoS) attacks to disrupt or deface websites. The hacktivist community’s growing interest in law firms is evident, especially those representing organisations at odds with hacktivists’ political, economic, or ideological stance, such as those involved in the life sciences or energy sectors.

Insider Threats: Deliberate or Accidental Risks

Insider threats pose deliberate or accidental security risks from individuals with authorised access, including employees, volunteers, contractors, or suppliers. Despondent or disgruntled staff, whether current or former, may exploit access to sensitive data and finances. Not always malicious, insider threats can result from inadequate staff training, cumbersome processes leading to corners being cut, or inadvertent mistakes, such as falling victim to a convincing phishing attack.

 

What are the common forms of attack?

Experiencing a cyber attack poses severe consequences for any business, particularly when its foundational principles revolve around trust and confidentiality. In the case of law firms, the ramifications extend beyond

financial concerns, encompassing irreparable damage to the practice’s reputation.

In light of these challenges, safeguarding law firms becomes imperative to preserve the security of their data and intellectual property (IP). It is crucial for them to stay informed about prevalent cyber threats, as highlighted in an NCSC report on the cyber threats to the UK legal sector, which identifies five major threats posing significant risks to the legal sector.

Supply Chain Attacks: Risks in Outsourcing

Many law firms, especially smaller ones, outsource IT and data management to specialist support companies, introducing supply chain vulnerabilities. The risk of third parties inadequately securing sensitive data poses a significant threat. Law firms may be targeted by cybercriminals seeking access to organisations they do business with, and their position in the global supply chain makes them attractive to nation-state actors. The distributed nature of modern supply chains increases opportunities for cyber attacks, impacting various aspects from finance and billing platforms to HVAC and janitorial systems.

Phishing: Deceptive Tactics for Data Compromise

Phishing involves the use of scam emails, text messages, or phone calls to deceive victims, with the primary goal of directing them to malicious websites. These sites may download malware, such as ransomware or viruses,

 onto the victim’s computer or capture sensitive information like bank details and login credentials. Law firms face an ongoing threat from phishing attacks, often concealed within the overwhelming volume of daily emails. Cybercriminals exploit information from law firm websites and social networks to launch more targeted attacks, utilising tactics like scam emails related to payroll account changes for new joiners.

Business Email Compromise (BEC): Targeted Financial Deception

BEC attacks, a form of phishing, specifically target senior executives or budget holders to trick them into transferring funds or disclosing sensitive information. Crafted to appeal to specific individuals, BEC attacks are challenging to detect and aim at law firms due to their involvement in significant financial transactions and handling sensitive documents. Criminals may use legitimate email accounts or ‘lookalike’ email addresses to deceive victims, often fabricating email chains with clients or suppliers to manipulate financial transactions.

Ransomware and Other Malware: Data Encryption and Extortion

Ransomware, a malicious software, encrypts or steals data, preventing access until a ransom is paid. Law firms, dealing with highly sensitive information, are particularly vulnerable to ransomware attacks. Attackers often demand payment in cryptocurrency and may threaten to publish sensitive data online. The diverse landscape of malware includes adware, viruses, worms, trojans, bots, keyloggers, and spyware, each posing unique threats to data security.

Password Attacks: Safeguarding Access and Credentials

Ensuring secure access to data, systems, and services is crucial, and law firms face identity and access management threats. Password reuse, weak passwords, excessive permissions, and open access can lead to unauthorised access. Implementing multi-factor authentication (MFA) is a critical defence against password attacks, adding an additional layer of authentication to prevent unauthorised access.

 

Protect your Firm with Arx Alliance

The Arx platform is unique. Our approach is collaborative rather than prescriptive. We give you the tools and the framework to create robust, secure supply chains in a way that is effective, and cuts through the noise and jargon of a complex industry.

Over time, through a guided step-by-step process, we can help you identify and mitigate risks inside your own organisation, and collaborate with your suppliers to create robust, secure supply chain relationships.

Arx provides your firm and suppliers with a suite of tools:

• Visibility of the organisation’s attack surfaces
• Efficient control of cyber policies and standards
• Central place for managing standards and controls
• Continuous monitoring of all touch points
• Situational awareness for all tiers of supply chain
• Risk scored suppliers to highlight weak links