Client Confidentiality
Privileged documents, deal data and personal details are exactly what extortion groups want to steal. A breach can breach professional duties as well as data protection law.
Professional Services
Protect the trust your clients place in you.
Law firms, accountants and consultancies hold some of the most sensitive information any organisation will ever share. Attackers know that one compromised inbox can be worth more than a whole network.
TOP THREATS: LEGAL & PROFESSIONAL SERVICESSector focus
Client ConfidentialityPrivileged documents, deal data and personal details are exactly what extortion groups want to steal.
Data Extortion GroupsSome groups now skip encryption entirely and simply steal files, then threaten to publish them or contact clients directly.
Payment Diversion FraudCriminals watch a compromised mailbox, wait for a completion or settlement, then send altered bank details at the perfect moment.
Cyber Essentials and Scheme RequirementsLegal aid contracts, public sector work and many panels now require Cyber Essentials as a minimum.
The threat picture
Why attackers target legal & professional services
Professional services firms sit at the centre of mergers, property completions, disputes and family matters. That makes client files valuable to extortion groups, and it makes the moment money moves a target for fraudsters who only need one convincing email.
We help firms protect client confidentiality, cut the risk of social engineering and give clients, insurers and schemes such as Cyber Essentials the evidence they now expect, without slowing fee earners down.
Data Extortion Groups
Some groups now skip encryption entirely and simply steal files, then threaten to publish them or contact clients directly. Law firms have been singled out because reputational pressure makes them more likely to pay.
Payment Diversion Fraud
Criminals watch a compromised mailbox, wait for a completion or settlement, then send altered bank details at the perfect moment. The email looks genuine because it often comes from a real account.
Cyber Essentials and Scheme Requirements
Legal aid contracts, public sector work and many panels now require Cyber Essentials as a minimum. Missing a renewal can mean losing the right to bid.
Client Security Questionnaires
Corporate clients increasingly send detailed security questionnaires before instructing a firm. Answering them well needs real evidence, not policy documents alone.
Regulation and standards
The rules you work under
The obligations that shape security in legal & professional services, and how we help you meet them with evidence rather than paperwork.
SRA Code of Conduct for Firms
Requires firms to have effective systems and controls, to identify and manage material risks to the business and to keep client affairs confidential. A serious cyber incident tests all three.
Official guidanceLegal Aid Agency Data Security Requirements
Providers holding legal aid contracts must meet the Agency's data security requirements, which include Cyber Essentials certification for contracts starting on or after 1 October 2025.
Official guidanceUK GDPR and the ICO
Firms must protect personal data with appropriate security and report qualifying personal data breaches to the ICO within 72 hours of becoming aware of them.
Official guidanceISO/IEC 27001
Not a legal requirement, but the information security standard many corporate and financial clients ask their advisers to hold or align with.
Official guidanceIllustrative scenario
A Completion Day Fraud, Stopped
How a typical attack on legal & professional services unfolds, step by step. Press play to watch it run.
- 1The phish
A conveyancing assistant enters their password on a fake document sharing page. Multi-factor authentication is not enforced on that account.
- 2The watch
The attacker quietly sets a mail rule and reads correspondence about an upcoming property completion for several weeks.
- 3The switch
On completion morning, an email from the real mailbox tells the client the firm's bank details have changed.
- 4Where it breaks
Email security flags the new forwarding rule and the risky sign-in, our analysts lock the account, and the firm's call-back procedure catches the changed details before any money moves.
Where Cybergen breaks the chain
Phishing simulations, email security, round-the-clock monitoring and a tested payment verification process each break the chain on their own. Together they make this kind of fraud very hard to pull off.
Illustrative example, not a real incident.
How we help
Security that fits how you operate
Sector insights
Latest thinking for legal & professional services
Law Firms Are Under Attack: Inside the Silent Ransom Group Threat
Silent Ransom Group targets law firms with callback phishing and data theft extortion. Learn how its attacks work and how to protect your firm today.
Read article · 9 min
Law Firms and Cyber Security: Safeguarding Confidential Data
Cyber security for law firms: how to assess risk, train staff, control access and encrypt client data. A practical guide to protecting confidential files.
Read article · 9 min
Legal Aid Providers: Are You Ready for December’s Cyber Essentials Deadline?
Cyber Essentials for legal aid providers becomes mandatory in December 2025. Learn the five controls, how certification works and how to meet the deadline.
Read article · 10 minOther sectors
Explore more sectors
Why are law firms targeted by cyber criminals?
Firms hold confidential client information and regularly move large sums of money. Both can be monetised quickly, through extortion or by diverting a payment at the right moment.
Is Cyber Essentials mandatory for law firms?
Not for every firm, but legal aid providers must hold it under the Legal Aid Agency's data security requirements, and many public sector and panel contracts ask for it too.
How can we stop payment diversion fraud?
Combine strong email security and multi-factor authentication with a firm rule that changed bank details are always confirmed by phone on a known number, and make sure clients know that rule.
Can you help us answer client security questionnaires?
Yes. We help firms build the policies, testing evidence and certifications that let them answer questionnaires accurately and quickly.
Get in touch
Talk to us about legal & professional services
Tell us about your organisation, the regulations you work under and what is worrying you most.
Prefer to talk? Call +44 (0) 1865 950 828
Or email [email protected]
Thanks, we've received your enquiry
A member of our team will be in touch to talk through your sector and requirements.