Sharp rise in cyber attacks at UK law firms as hackers eye sensitive data

The number of reported cyber attacks on UK law firms has increased 36 per cent over the past year.

According to data by speciality reinsurance group Chaucer, there were 166 reported cyber breaches in 2021/22, this number jumped to 226 for 2022/23 (as of 30 September).

Chaucer says that the large number of attacks against law firms has been driven by a belief amongst hackers that law firms are particularly vulnerable to ransomware attacks and threats from the hackers to publish information stolen online.

Ben Marsh, deputy class underwriter at Chaucer, explains: “The extremely sensitive data that law firms hold on behalf of their clients makes them a very attractive target to hackers.”

“Hackers expect that law firms will pay them to either unlock data they encrypt in ransomware attacks or pay “blackmail” in exchange for the hackers not publishing the law firm’s stolen data online.”

“Attacks against law firms are part of that smaller group of cyber-attacks where the business is being actively targeted. That means that law firms need stronger cyber defences than the average business. Most cyber-attacks start almost randomly when a hacker’s software identifies an organisation with a flaw in their security,” he added.

The National Cyber Security Centre (NCSC) cyber threat report 2023 also noted that nearly-three quarters of UK’s Top 100 law firms have been impacted by cyber-attacks.

The Information Commissioner’s Office (ICO) and the NCSC warned lawyers back in 2022 that they should not advise their clients to pay out ransoms to hackers.

Magic circle law firm Allen and Overy was added to a well-known cybercriminal group, LockBit’s victim list# last November. They claimed they would publish all of the data they got on the firm by 28 November.

When asked by the Law Gazette if the firm paid the ransom to cyber-criminals, A&O declined to comment. The firm said in the aftermath of the cyber-attack that a ‘small number’ of storage servers had been targeted, but that core systems including email and document management were not affected.

However, just this week, it was revealed that the UK’s National Crime Agency (NCA), along with the FBI, Europol and other international police agencies took control of Lockbit.