Cybersecurity for UK law firms: key threats, regulatory duties and how to protect your firm

Law firms do not have a cybersecurity tooling problem. They have an assurance problem.

Cyber attacks go straight for three things a law firm cannot afford to lose: privileged information, client money and control of deadlines. Lose any one of them and the consequences reach well beyond IT, into operations, professional standing and regulation.

The government's Cyber Security Breaches Survey, published in April 2026, found that 43% of UK businesses had identified a cyber breach or attack in the previous 12 months, rising to 65% of medium-sized and 69% of large businesses. The government cautions that unidentified attacks mean the true figure may be higher. The survey does not report the legal sector separately.

The test for a firm is whether it can prove its controls work: who can access client information, which suppliers hold it, whether unusual activity will be detected, and how quickly the firm can recover. That distinction matters even more as regulatory expectations extend further into the technology supply chain.

This guide to cybersecurity for law firms is written for managing partners, COLPs and COFAs, risk and compliance leads, and IT directors. It covers the threats that matter most to UK law firms, the duties that apply, what changes next, and a practical framework for reducing risk.

Key takeaways

• Many attacks start with people and identity: phishing emails, and calls from criminals posing as IT support.
• Extortion no longer depends on encryption: a firm can be held to ransom without a single system going down.
• Supplier and legacy-system failures can create prolonged disruption, as the 2025 Legal Aid Agency breach
• Proposed UK legislation would bring IT service providers into regulation, so firms should ask now what evidence their providers can give of their own resilience.

Why law firms are targeted

Criminals target law firms for two reasons: the pay-off is high, and so is the pressure to pay.

• Privileged and sensitive data. Merger terms, litigation strategy, family and criminal matters, and personal data are valuable to sell, to trade on or to use as leverage.
• Client money. Conveyancing and completion monies move in large, predictable amounts, often on known dates.
• Time-critical work. Completions and court deadlines do not move because a firm has suffered a cyber incident. Attackers exploit that pressure.
• Professional consequences. A breach can mean regulatory reporting, client notification, insurer scrutiny and lasting damage to trust.

That last point shapes the economics. Alongside the remediation bill, a firm carries the cost of the conversations with clients, regulators and insurers that follow an incident.

The main cyber threats facing UK law firms

The cases below underline a recurring point: sophisticated outcomes do not always require sophisticated entry points.

Threat	How it affects a law firm	Typical impact	First control
Ransomware and data extortion	Attackers steal client files and threaten to publish them, with or without encrypting systems	Regulatory reporting, client notification, downtime	Monitor outbound data and keep tested, offline backups
Payment diversion and business email compromise	A criminal intercepts or spoofs email and changes the bank details for completion monies	Direct loss of client money and complaints	Verify any change of bank details by phone, using a known number
Phishing, credential theft and IT impersonation	Staff are tricked by email or phone into handing over access or installing remote-access tools	Account takeover, a foothold for wider attack	Multi-factor authentication for everyone, and a help-desk identity check
Human error	Misdirected emails, wrong attachments or data shared on unapproved tools	Data breach and possible ICO report	Email safeguards, data loss prevention and training
Third-party and supply-chain risk	A supplier, platform or case management provider is breached or goes offline	Lost access to systems, payments or data held elsewhere	Supplier due diligence and continuity plans
AI-enabled attacks and shadow AI	Convincing AI-written phishing; staff pasting client data into unapproved AI tools	Confidentiality breach, regulatory exposure	An AI use policy and approved tools
Unpatched and legacy systems	Old systems and unused admin accounts remain reachable	Easy entry for attackers	Patch, retire or isolate, and remove dormant accounts

Extortion no longer depends on encryption. Since 2023, a group known as Silent Ransom Group has targeted law firms by phoning staff while posing as IT support, then stealing data to extort the firm. Its 2026 victims include several large US firms, according to Google's Mandiant threat intelligence team and an FBI alert.

Basic controls still change outcomes. In April 2025, the ICO fined DPP Law £60,000 after attackers accessed its network through an infrequently used administrator account that lacked multi-factor authentication. More than 32GB of data was taken. The firm became aware that client information had been posted on the dark web only when the National Crime Agency contacted it.

Supplier failure can stop a firm working. The Legal Aid Agency found a cyber attack in April 2025 and took its online services offline on 16 May 2025. Applicant data going back to 2007 may have been accessed, and legal aid firms relied on contingency payment arrangements for months. Full billing on the CCMS case management system returned for civil providers on 1 December 2025.

Regulatory and professional duties

This section summarises regulatory duties for general information. It is not legal advice; firms should take advice on their own obligations.

For a law firm, cybersecurity sits inside duties it already owes: to the SRA, under UK GDPR and to its insurers.

SRA obligations. Firms must keep client affairs confidential, protect client money and have effective governance, systems and controls. The COLP is responsible for compliance with the regulatory arrangements, and the COFA for compliance with the Accounts Rules, so both roles have a direct stake in cyber risk. Firms must also report serious breaches to the SRA promptly.

AI governance. On 17 August 2026 the SRA published a warning notice on the misuse of AI. It says paid and free AI tools may lack the contractual and technical safeguards needed to protect client confidentiality, and expects firms to have governance and controls over AI use. Solicitors who ignore the notice risk disciplinary action.

UK GDPR. Firms must protect personal data with appropriate technical and organisational measures. A personal data breach must be reported to the ICO within 72 hours of the firm becoming aware of it, unless it is unlikely to pose a risk to individuals. The maximum fine for the most serious breaches is £17.5 million or 4% of annual worldwide turnover, whichever is higher.

Insurance. Professional indemnity insurance responds to claims from third parties. It does not usually cover the firm's own costs of dealing with a cyber incident, which is why many firms buy separate cyber cover. Insurers increasingly ask for evidence of controls such as multi-factor authentication and tested backups.

Standards that demonstrate control:

• Cyber Essentials and Cyber Essentials Plus. The government-backed baseline. From 27 April 2026, failing to switch on available multi-factor authentication for a cloud service is an automatic fail, and cloud services cannot be excluded from scope.
• ISO 27001. The international standard for an information security management system.

What law firms need to watch in 2027

The direction is consistent: regulators want evidence that controls work, faster incident reporting and more accountability from the suppliers firms depend on. Much of this is not yet law, so the table separates current status from what it could mean.

Change	Status at the time of writing	What it could mean for law firms
Cyber Security and Resilience (Network and Information Systems) Bill	Progressing through Parliament. Not yet law	As drafted, it would bring managed service providers and data centres into scope. Most firms would feel this through their IT suppliers' contracts and assurance
Ransomware proposals	The government published its consultation response in July 2025 and says it will continue to develop a public sector payment ban, a payment prevention regime and mandatory incident reporting. No bill has been introduced	Firms should make sure their incident response plans could accommodate additional ransomware notification requirements if the proposals become law
Post-quantum cryptography	NCSC guidance asks organisations to complete discovery and build an initial migration plan by 2028, and to complete migration by 2035	Discovery includes understanding where suppliers carry the dependency
AI governance	SRA warning notice published August 2026	Expect AI policies and approved tools to feature in client, insurer and regulator questions
Cyber Essentials	Stricter requirements apply to assessments started from 27 April 2026	Cloud services without available multi-factor authentication switched on now fail certification

My read is that this changes what firms should ask their providers. Alongside 'can you protect us?', firms will need to ask 'what evidence can you give us about your own resilience, accountability and regulatory readiness?'

Post-quantum cryptography is a good example. For firms holding long-lived confidential information, my view is that 2027 is a sensible time to start understanding where cryptography is used and where suppliers carry the dependency.

Why defending a law firm is hard

The harder task is turning the technology a firm already owns into control it can evidence.

Tool sprawl and alert fatigue. More security technology does not automatically produce greater assurance. Every additional control needs somebody to configure it, monitor it and act when it signals a problem. The work lies in deciding which alerts matter and who owns the response.

Threats that change faster than playbooks. Attackers now combine email, phone calls and legitimate remote-access tools. Keeping pace needs continuous monitoring that a stretched in-house team struggles to sustain.

The skills gap. Cyber expertise remains difficult to build and maintain in-house. The government's 2026 cybersecurity labour market study found that 57% of businesses had a basic technical skills gap, while demand for cyber skills had increased compared with 2024. For most firms, building specialist detection, investigation and response capability around the clock is a significant undertaking.

Security friction for fee-earners. Fee-earners bypass controls that slow down billable work. Design controls around how fee-earners work, and test them with fee-earners before rollout.

Leadership ownership. Only 31% of UK businesses have a board member or trustee with responsibility for cybersecurity, and only 57% of medium-sized businesses have a formal incident response plan. In a partnership, decisions on risk appetite and investment need partner-level ownership as well as IT sign-off.

A practical security framework for law firms

This framework follows the six functions of the NIST Cybersecurity Framework 2.0, adapted for how law firms work. Start with governance, because every other decision depends on it.

Govern: own the risk at partner level

• Assign executive ownership for cyber risk, working with the COLP and COFA, and agree which services, matters and data the firm cannot afford to lose.
• Set an AI use policy that names approved tools, in line with the SRA's warning notice.
• Review suppliers that hold client data or run critical services, and ask what evidence they can give of their own resilience.

Identify: know your data, systems and suppliers

• Map where client and matter data lives, including email, document management, case management and cloud storage.
• Keep an up-to-date inventory of devices, applications, accounts and suppliers.
• Find dormant, shared and over-privileged accounts.

Protect: make the common attacks fail

• Multi-factor authentication for every user and cloud service, and least-privilege access reviewed at least quarterly.
• Patching to a defined timescale, with legacy systems retired or isolated.
• Email security that flags spoofed and lookalike domains.
• Endpoint protection, encryption and protected backups.
• Training and phishing simulations, including phone-based impersonation, backed by a help-desk identity check.
• A payment verification procedure: confirm any change of bank details by phone, using a number already on file.

Detect: see an attack early

• Monitor sign-ins, privileged activity and data leaving the firm.
• Define what 24/7 coverage means for the firm: who watches overnight, who can act, and how fast.

Respond: rehearse before you need it

• A written incident response plan with named roles, including partners, the COLP and communications.
• Tabletop exercises at least annually, including a data extortion scenario.
• A clear notification path: ICO within 72 hours where required, the SRA, insurers, clients and, where relevant, the police.

Recover: prove you can get back to work

• Test restores from backup on a schedule, and record how long they take.
• A continuity plan for losing a key supplier or platform, including how completions and court deadlines are met.

Quick-wins checklist

Start with the first five this month.

• Turn on multi-factor authentication wherever it is supported
• Remove dormant and unnecessary privileged accounts
• Verify any change to payment details independently, by phone
• Test a full restore from backup
• Rehearse an incident with the firm's decision-makers
• Introduce a help-desk identity check for resets and remote sessions
• Approve AI tools and issue an AI use policy
• List suppliers holding client data and confirm their security assurances
• Check your Cyber Essentials status against the April 2026 requirements
• Assign executive ownership for cyber risk and agree the firm's risk appetite

Should your firm work with a managed security provider?

The right model depends on what the firm can staff, what it must evidence and how much risk it is prepared to hold itself.

Model	Best suited to	What the firm keeps	Watch out for
In-house	Larger firms with a security team and budget for round-the-clock cover	Full control and full accountability	Cost of 24/7 staffing, retention of specialists
Co-managed	Firms with an IT team that needs specialist depth or out-of-hours cover	Day-to-day IT and decisions, with a provider monitoring and responding	Clear split of responsibilities, especially overnight
Fully managed	Firms that want security delivered as a service with defined outcomes	Governance, risk appetite and supplier oversight	Contract terms, reporting quality and exit arrangements

Managed cybersecurity for law firms can give a firm continuous monitoring, specialist detection and response capability, and reporting that helps evidence control to clients, insurers and regulators. But outsourcing operations does not outsource accountability: the firm remains responsible for its regulatory duties.

Questions to ask a provider

1. What are your security operations centre (SOC) hours, and where is it staffed?
2. Which accreditations do you hold, such as ISO 27001 and Cyber Essentials Plus?
3. What response times do you commit to, and what actions can you take on our behalf without waiting for approval?
4. What legal-sector experience can you evidence?
5. How do you work with the Microsoft security tools we already pay for?
6. What will our reporting show, and how often?
7. How are you preparing for the requirements proposed in the Cyber Security and Resilience Bill?
8. What happens to our data, logs and configurations if we leave?

How OneAdvanced can help

OneAdvanced provides managed cybersecurity services built around the Microsoft security ecosystem.

Whichever model a firm chooses, good looks like this: partners who own the risk, controls the firm can evidence, a plan that has been rehearsed, and suppliers whose assurances have been checked rather than assumed.

My read is that clients, insurers and regulators are taking the cyber conversation in legal services beyond protection to proof. They want to know whether a firm's controls work, whether its recovery has been tested, and whether the suppliers it relies on can provide the same assurance.

Frequently Asked Questions

Why are law firms targeted by cybercriminals?

They hold privileged information, move large sums of client money and work to deadlines that make disruption expensive. That combination raises both the value of stolen data and the pressure to pay.

What cybersecurity does the SRA expect?

The SRA expects firms to protect client confidentiality and client money and to have effective governance, systems and controls. Its August 2026 warning notice makes clear that existing professional obligations continue to apply when firms use AI.

Do we have to report a breach to the ICO or SRA?

A personal data breach must be reported to the ICO within 72 hours unless it is unlikely to pose a risk to individuals. Serious breaches of SRA requirements must be reported to the SRA promptly. Notify your insurer early too.

Do we need Cyber Essentials?

It is not a legal requirement for most firms, but clients, insurers and public sector contracts often ask for it. It is also a practical baseline: the April 2026 requirements fail any cloud service where available multi-factor authentication is not switched on.

What should law firms watch in 2027?

The Cyber Security and Resilience Bill, not yet law at the time of writing, would bring IT service providers into regulation. Ransomware reporting rules are proposed but not yet legislated, and the NCSC asks for post-quantum migration plans by 2028. Expect clients, insurers and regulators to ask for evidence that a firm's controls, and its suppliers, hold up.

What should we do first to reduce risk?

Start with multi-factor authentication wherever it is supported, remove dormant and unnecessary privileged accounts, independently verify changes to payment details, test a full restore and rehearse an incident with the firm's decision-makers.

How much does managed cybersecurity cost?

Cost depends on the number of users and devices, the hours of cover, the tools already in place and how much response the provider carries out. The useful comparison is against the full cost of building equivalent 24/7 cover in-house.

Talk to us about your firm's cyber risk

Find out where your firm's exposure sits.

Contact us today.