It’s Monday morning. A partner opens their laptop and every case file is locked. There’s a ransom note on the screen, completions are due this week, and nobody knows who to call first.
Law firm cyber security used to sit with whoever knew about computers. Now it’s a regulatory issue. The SRA expects you to manage the risk, and the ICO has fined law firms that didn’t, including one in Merseyside.
This guide is for partners, COLPs and practice managers at small and mid-sized UK practices. You’ll get what the regulators expect, what two real fines teach, and which controls come first and what they cost. You’ll also get a plan for the first 72 hours after an attack.
Why are law firms a target for cyber criminals?
Law firms hold what criminals want: client money, confidential files and deadlines that can’t move. A firm facing a completion or a hearing is under pressure to act fast. That’s when mistakes happen.
Email is the usual way in. The SRA said over 80% of the cybercrime reports it received in 2021 involved email. Firms also reported 18 ransomware attacks to it that year.
Its review of 40 firms that had reported incidents found over £4 million of client money had been stolen from 23 of them. Only 27 had a disaster recovery plan, and 15 of those kept it on their own systems. If ransomware hits, that plan is locked too.
Some balance helps. Those SRA figures are a few years old. Reported client losses fell from about £10 million in 2017 to about £2.3 million in 2021. The wider risk hasn’t gone away, though. The government’s Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses identified a breach or attack in the last 12 months. For medium businesses it was 65%.
Picture a 12-person conveyancing practice on the Wirral. A fee earner’s mailbox is hacked and a forwarding rule sits there for weeks. The attacker reads every completion email, then sends a buyer “updated” bank details. Nothing on the firm’s network looks wrong. (This is an illustrative example, not a real case.)
What are the SRA cyber security requirements?
The SRA’s Code of Conduct for Firms doesn’t list specific technical controls. It sets standards, and cyber risk falls under several of them.
| Paragraph | What it says | What it means for cyber security |
|---|---|---|
| 2.1 | Have effective governance, systems and controls | A named owner, written policies and evidence you follow them |
| 2.5 | Identify, monitor and manage all material risks | Cyber belongs on your risk register and gets reviewed |
| 3.5 | Be honest and open with clients if things go wrong | A plan for telling clients what happened |
| 3.9 and 3.10 | Report serious breaches and other relevant matters to the SRA promptly | Agree your reporting threshold before you need it |
| 4.3 | Make sure managers and employees are competent | Train everyone, partners included, and keep records |
| 6.3 | Keep client affairs confidential | Protect mailboxes, files and devices, including at home |
The SRA’s cyber security advice adds practical detail. It tells firms to give someone senior responsibility, apply patches promptly and use two-factor authentication. It also says to keep a list of your systems, keep backups and carry out due diligence on IT providers.
You’ll know these paragraphs better than we do. The usual gap is evidence. If the SRA asked tomorrow, could you show your risk register, your training records and a tested backup?
What can you learn from ICO fines against law firms?
Two UK cases show how the ICO looks at law firms. In both, the failings were basic.
| Tuckers Solicitors | DPP Law Ltd (Merseyside) | |
|---|---|---|
| Fine | £98,000 (March 2022) | £60,000 (April 2025) |
| What happened | Ransomware in August 2020 encrypted 972,191 files. 60 court bundles were published online | An attack in June 2022 disrupted systems for over a week. Over 32GB of data was taken |
| Key failing | No multi-factor authentication (MFA) on remote access, and unencrypted archive data | A rarely used admin account on a legacy case management system had no MFA |
| Reporting | Reported the day after it became aware | Reported 43 days after it became aware |
Three lessons stand out:
- MFA is the baseline. The ICO called it a “comparably low-cost preventative measure” in the Tuckers case.
- Old systems still count. In the DPP case, one forgotten account on a legacy system was enough.
- Losing access can be a breach. DPP didn’t think losing access to personal data counted. The ICO disagreed. DPP only learned its data had been stolen when the National Crime Agency told it the data was on the dark web.
Which law firm cyber security controls matter most?
Start at the top of this table and work down. The first three need little or no new software.
| Priority | Control | Why it matters | Cost |
|---|---|---|---|
| 1 | MFA on email, remote access and every admin account | The gap in both ICO cases | Often already in your Microsoft 365 plan |
| 2 | Mailbox forwarding checks and email authentication (SPF, DKIM, DMARC) | Finds hidden rules and makes your domain harder to spoof | Mostly setup time |
| 3 | A call-back rule for any change to bank details | Stops payment fraud even if a mailbox is hacked | Free |
| 4 | Tested backups, with a copy attackers can’t reach | Your way back from ransomware | Depends on data volume |
| 5 | Patching, and retiring old systems and accounts | Removes what attackers look for first | Quote after a systems review |
| 6 | A proper leavers process | Old accounts stay open otherwise. Use our IT offboarding checklist | Free |
| 7 | Regular training with no-blame reporting | Staff speak up quickly after a bad click | Varies by provider |
| 8 | Cyber Essentials | Forces the basics and gives you evidence | £320 + VAT (under 10 staff), £440 + VAT (10-49 staff) |
Two free NCSC services are worth using this month. Early Warning emails you about threats tied to your IP addresses and domains. Exercise in a Box lets you practise a ransomware scenario with your partners.
Go back to the Wirral practice. Priorities 1 to 3 could be done in a planned afternoon with its IT provider. That alone would catch the hidden forwarding rule and stop the fake bank details. (Illustrative example.)
Do law firms need Cyber Essentials?
For most firms it isn’t a legal requirement. Legal aid work is the main exception. The Legal Aid Agency’s Provider Data Security Requirements make holding Cyber Essentials, or an equivalent standard, mandatory for the life of the contract. Cyber Essentials Plus is recommended.
Even if that doesn’t apply to you, it’s useful evidence. The Law Society lists it among the certifications to consider, and the government survey found only 5% of businesses hold it. Certificates last 12 months, so build renewal into your compliance calendar.
What should you do in the first 72 hours of a law firm cyber attack?
The government survey found only 25% of businesses have a formal incident response plan. Yours should fit on one page. Print it, because your systems may be down when you need it.
- First hour: contain it. Disconnect affected devices from the network. Don’t wipe anything. Call your IT provider.
- First hour: protect the money. If client money may be at risk, call your bank’s fraud team and hold pending payments.
- Day one: call your insurer. Check the notification terms in your cyber and PII cover.
- Day one: work out what’s affected. Record whose data is involved, what happened and when you became aware.
- Within 72 hours: tell the ICO. Notifiable personal data breaches must be reported within 72 hours.
- Promptly: tell the SRA. It expects firms to report successful attacks even if there are no concerns about conduct or systems. Report any client money loss too.
- Promptly: put things right. Be open with affected clients. Under the SRA Accounts Rules, you must immediately replace client money that’s been improperly withdrawn.
- Report the crime. Report Fraud replaced Action Fraud in December 2025. Call 0300 123 2040 or use reportfraud.police.uk.
If a ransom note appears, don’t reply or pay until you’ve taken advice. Then run a review once things are stable, and update your risk register.
Should you outsource cyber security for your law firm?
Many firms do. The SRA’s review found 75% of the firms it visited used third-party IT professionals. Outsourcing the work doesn’t outsource your duties under the Code, so check your provider properly. Ask:
- Is MFA on every account, including partners and admin accounts?
- When did you last test a restore, and can we see the result?
- What do you check in our mailboxes, and how often?
- What happens in the first hour if we’re hit?
- Are you Cyber Essentials certified?
- Will you work directly with our case management supplier?
Vague answers tell you a lot. Picture a practice in Chester asking the restore question and hearing “the backups run every night”. That’s not the same as knowing they work. (Illustrative example.)
Cirrus is based in Ellesmere Port, with a 7-day service desk and a 15-minute average response time, and we’re Cyber Essentials certified. Our cyber security services for small business cover email security, Cyber Essentials and staff training. You can read more on our IT support for professional services page.
Cyber security for law firms: FAQs
Does professional indemnity insurance cover cyber attacks?
Don’t assume it does. The SRA tells firms to check whether their PII covers cybercrime losses and to consider specific cyber insurance. The government survey found only 10% of businesses have a specific cyber policy.
Do we have to report every phishing email to the SRA?
No. The SRA says large firms that get many unsuccessful attacks each day needn’t report each one, unless it’s particularly significant. Successful attacks are different. Keep your own record of attempts either way.
Should a law firm pay a ransom?
The NCSC and ICO don’t encourage or condone it. Their 2022 letter to the Law Society said paying “will not keep data safe” or count as mitigation with the ICO. Speak to your insurer and IT provider first.
Want to know where your gaps are?
Book a free, no-obligation IT review call. We’ll talk through your offices, systems and payment process, then point out the risks and quick wins we spot. No hard sell. Get in touch or call 0330 313 0966.