Cyberattacks Against Law Firms

What You Need to Know and How to Prevent Them

As the intensity of cyberattacks against businesses continues to rise, law firms have become one of the cyber criminals’ prime targets. Since law firms manage some of the most confidential data for their clients and have access to an extensive network of potential new clients, they have become far more vulnerable than other businesses.

In response to the increasing frequency and scope of cyberattacks against law firms, cybersecurity and managed services provider Protected Harbor has launched a new security awareness program titled, “Cyberattacks Against Law Firms and How to Prevent Them.”

The program consists of two resources: an e-book featuring the top law firm hacks throughout history as well as a whitepaper detailing the cyberattacks against law firms’ and what their trends and threats are. Both versions are free to download!

Now, we will discuss a little bit of background on cyberattacks against law firms and a few quick, various ways you can reduce your organization’s risk to getting attacked.

Background on Law Firms and Why They Are Such a Target

Poor cybersecurity is now one of the most significant hazards a legal business can encounter and is no longer only a concern for technology. Major law companies in the US have recently suffered catastrophic cybersecurity breaches that has cost them millions of dollars. Cybersecurity is not just the responsibility of the IT department, it’s instead something that must be covered within the company’s overall policies for utilizing technology within the business or in its services.

A lot goes into cybersecurity, and some businesses are too small to get the complete expertise of IT professionals. Due to the expenditures, medium and big businesses may put off planning for cyber-attacks or assume they won’t be affected which in turn is a huge mistake.

Until recently, law companies were seen as primarily analog in nature. The risk of a cyber breach was typically minimized by attorneys and staff manually tracking client and firm information. But, as businesses embrace innovation and clients want more technologically sophisticated communications and strategies, law firms have made the switch to a more technologically advanced environment and are now more vulnerable to cyberattacks than they were previously.

Law firms, in particular, are viewed as attractive targets for hackers, with numerous high-profile attacks being covered in the media. According to a recent study by the American Bar Association, more than 20% of law businesses reported being the target of a cyber-attack. This percentage was 35% among legal companies with roughly 10 to 49 attorneys. This means that more than a third of small law firms had experienced hacking in some shape or form.

These data breaches are concerning for reasons other than the victims’ embarrassment or the possibility of identity theft. A 2017 study found that the average cost of a data breach outside the US is around $3.6 million, or $141 per record. The amount is considerably larger in the United States at $7.3 million, not to be surpassed.

The consequences of a data breach go beyond the loss of individual details. Trust in the compromised institution can be destroyed by a single breach, a fate which many practices cannot recover. In reality, “almost 60% of [small businesses] forced to cease operations after a cyber assault never reopen for business,” according to a Forbes article.

6 Tips to Protect Your Law Firm Against Cyberattacks

1. Improve Your Security Culture
2. Implement Basic Cybersecurity Measures
3. Encrypting Sensitive Data
4. Proactive Security
5. Securing Network with Firewalls
6. Keeping Antivirus Updated is a Must

Download our e-book for free to read in detail the tips on how to protect your law firm and best practices.

Conclusion

You must have a plan before cyber criminals attack your law firm. After dealing with a data breach at your legal company, you want to be sure to take immediate action. Consider communications in particular when creating your plan. The best way to prevent your law firm from becoming the next cyberattack victim is to implement a cybersecurity program that includes preventative measures, detection, and response strategies. Instead of having a client accidentally learn the terrible news, the law firm must be the one to deliver it.

Download our e-book Cyberattacks Against Law Firms and How to Prevent Them, which we have created specifically for legal companies. Within this e-book, you will learn about the most common cyberattacks against law firms and how you can prevent them from happening to your company. We also give you access to our e-book library with our most requested titles.

Get started and download today!

Lawyers Getting Hacked:

Most Popular Cyberattacks on Law Firms

From the time of their first email to the last signed document, law firms are under constant surveillance from cyber criminals. From phishing scams to ransomware and malicious websites, hackers know exactly where to strike to cause the most chaos. Rather than a once-in-a-blue-moon event, lawyers getting hacked is a commonplace occurrence for many firms. It’s almost as if there’s some hidden, “Get Hacked” switch that nearly all law firms have within them.

If you’re reading this and thinking, “that won’t be me,” you’re wrong. It just hasn’t been you, yet.

We are excited to announce our e-book on Top Law Firm Hacks Throughout History, available to download for free. This e-book will cover some of the most popular law firm hacks throughout history including some you may not have heard of prior.  We will also be providing some advice for avoiding common law firm pitfalls.

Below is a short glimpse into topics you can expect from our e-book.

Why are Law Firms an Attractive Target?

Due to the nature of their industry, law firms are becoming a more attractive target. Law firms and in-house legal teams gather a ton of sensitive information, an example such as tax returns can arise during their corporate legal and M&A (mergers & acquisitions) work, litigation, and other legal services. Businesses may suffer reputational and financial damages if they were to ever suffer a breach, especially if their data is compromised. According to a recent analysis from the security company CrowdStrike, average ransomware payouts are above $1 million.

Unfortunately, legal companies are usually more vulnerable compared to other business types. In a report published in May 2020 by the security company BlueVoyant, it was discovered that all law companies were the prime target of focused threat activity, and 15% of a global sample that included thousands of law firms had networks that were already infiltrated.

According to research released in October by the American Bar Association, it was discovered that 36% of legal firms had previously experienced malware infections within their systems and that 29% of law firms had reported a security breach, with more than 1 in 5 admitting they weren’t sure if one had ever occurred.

Robust security measures not being used could be a part of the problem.

Only 43% of respondents utilize file encryption, less than 40% use email encryption, two-factor authentication, and intrusion prevention, and less than 30% use full disk encryption and intrusion detection, according to the 2020 ABA Legal Technology Survey Report.

Law Firms as Critical Infrastructure

According to BlueVoyant’s report, the legal sector needs to be included on the list of 16 critical infrastructure sectors maintained by the U.S. government since it relies on networks and data that, if compromised, would jeopardize economic security or public safety. An analysis of cyber threats and vulnerabilities and information sharing with the Department of Homeland Security and other agencies would benefit law firms that handle and store government secrets.

However, legal firms may be hesitant to provide information about attacks out of concern that they would lose control of their sensitive data. Government agencies may begin to view law firms as an attack vector that requires protection as these attacks on the sector become more frequent, and information of relevance to other countries is compromised.

Considering ransomware attacks, there are a lot of factors that every firm should take into account. Along with employee training on appropriate security practices, cybersecurity steps like enabling two-factor authentication, backing up data, keeping software patched, and maintaining software updates are essential. In the case of a ransomware attack, businesses should have a plan in place that specifies what they will do, who will negotiate the ransom, and if they would pay it. Additionally, it’s beneficial for businesses to hold their data in secure cloud repositories, and it’s essential to thoroughly assess providers who keep the data.

The Most Notable Law Firm Cyber Attacks

We’ve produced a list of the most significant cyber-attacks and cyber-threats targeting law firms to highlight the escalating danger and consequences.

• Mossack Fonsesca & The Panama Papers
• JP Morgan Chase
• Oleras Phishing Campaign Against Law Firms
• UPMC Patients
• Moses Afonso Ryan Ltd.

Download our free e-book to read in detail about the top cyber-attacks on law firms.

Conclusion

Cybercriminals want access to a company’s data and intellectual property. Many of the most severe attacks directly involve the theft of private information to assist insider trading schemes or to commit theft and extortion of client information from legal firms.

Law firms are tempting targets for hackers. More often than not, law firms don’t take the necessary precautions to protect their data making them an easy target for malicious attacks. Law firms must do everything they can to protect their data starting with reviewing and updating their cybersecurity strategy. This includes everything from the hardware to the software they use within their network. Once they’ve identified the areas that are in need of improvement, they can implement new cybersecurity solutions to keep their data secure.

Download our free e-book today and learn about the risks as well as the most notable hacks in history! This e-book was created by a dedicated team of security experts with extensive experience working within the legal sector to provide some insight and tips to keep your company safe from cyber criminals.

Don’t forget to keep in touch with our blogs for more information and tips on law firms and cybersecurity.

The Biggest Data Risks and Cybersecurity Trends for Law Firms

In the digital age, law firms are operating within a high-risk environment. The number of cyber-attacks continues to rise, as do the associated costs. Recent studies suggest that, on average, small and medium-sized businesses spend more than $200 million annually on cyber security breaches.

These statistics show just how important it is for companies of all sizes to take cybersecurity seriously as well as highlight the risks involved in working with sensitive data. After all, no company wants their clients’ personal information to fall into the wrong hands.

We are excited to launch our 2022 Law Firm Data Breach Trend Report white paper. This report will be a compilation of data analysis from hundreds of law firms across the globe, as well as interviews with more than 100 partners and senior-level executives from the largest law firms in the US. We have learned a lot from these conversations and are excited to share our findings with you.

Download the white paper for free today!

Protecting Client Data:

The Biggest Challenge for Law Firms

Protecting client data is a top concern for law firms of all sizes. While most firms are diligent in protecting sensitive data and complying with local, state, and federal regulations, some are not.

After being asked to identify their most significant challenges when it comes to safeguarding client data, 58% of law firms cited, “managing the sheer volume of data,” and, “ensuring data is secure,” as their primary concern. These findings make sense if we consider that, on average, law firms store more than 5,000 gigabytes of data. The large volumes of data makes it difficult for law firms to constantly comply with the most up-to-date security protocols.

Top Threats

Your client’s data is constantly in danger from simple breaches, such as those resulting from a stolen laptop to even more extensive hacking schemes.

Here are a few actions you’re probably doing now that can endanger your clients most sensitive information.

• 

  Skipping Assessments – To help prevent a data breach, an annual inventory should be taken to understand what devices and data you have, where they are located, and who has access to them. It’s also essential to conduct a security and risk assessment. How vulnerable is your information? What would the ramifications be if it was stolen?

• Understaffed and Underfunded IT Departments – A majority of IT departments are usually very understaffed and overburdened with day-to-day work. This leaves little time for them to improve their security infrastructure, as they always react rather than improve.
• Lack of Employee Security Training – Analysts claim that non-malicious attacks are the most common security breach that law organizations face. Unfortunately, many legal companies have failed to adequately train their employees on IT security basics.
• Cloud Migration & Apps – Your business needs to make sure it has a good strategy when it comes time to migrate, including fundamentals like access control and governance, API integrations, and continuous monitoring.

Recent Law Firm Breaches

New York City’s Law Department (July 2021)

Grubman Shire Meiselas & Sacks (May 2020)

Vierra Magen Marcus (May 2020)

Mossack Fonseca (April 2016)

Top Cybersecurity Trends for 2022

Use Password Authenticator – Password authentication is a method in which a user enters a unique ID and key compared to previously stored credentials. It is one of the quickest forms of security; you can set up your device to require some identification before letting someone access it. This can be done using a passcode, PIN, password, fingerprint, or a 2-factor authentication (2FA).

Use Effective EDR – Using effective EDR (Endpoint Detection and Response) tools can help you improve the security of your network by aggregating data on endpoints, including process execution, endpoint communication, and user logins.

Move to a Virtual Server – Moving to a virtual server is essential as it has many benefits that address the security concerns law firms face. These benefits include getting the ability to prioritize critical traffic and improving network agility while reducing the burden from the IT department.

Isolated Backups – A remote or isolated backup is stored separately from other backups and is inaccessible from the end-user layer. Creating a remote backup helps to reduce security breaches, especially ransomware attacks.

Know Your Network Map – Understanding the network map is critical to complying with data privacy regulations as it provides an overview of devices and data on your network. This overview is crucial in identifying and minimizing the attack surface of a system. It will also uncover devices that IT staff may not know are there—for instance, an old, decommissioned server.

Timely Software Updates – It sounds simple, but vulnerabilities caused by outdated software are a significant problem. Keeping all the software up to date is essential for better performance. It also helps discourage potential cybercriminals who like to take advantage of previously-found weaknesses in software.

Data Encryption – In 2022, law firms must use encryption methods for systems, data in the cloud, data at rest, and data in transit to protect their files. Hard drives, USB devices, and phones should also use encryption if they are holding sensitive data

To read the cybersecurity trends for 2022 in detail, download our free white paper today.

Conclusion

By 2023, 80% of law firms will have experienced a data breach, according to research from LexisNexis. Given the rising number of cyber-attacks law firms face, it is necessary to take cybersecurity seriously. Law firms can better protect their sensitive data against these cyber threats by investing in the latest security technologies.

Protecting sensitive client data is essential for all law firms.

Stay on top of the latest trends and best practices for data security by downloading our white paper today! We highlight what law firms should be doing to protect their data and prevent a breach from ever happening. Protected Harbor also has other resources to prevent a law firm data breach, which you can access free from our digital library.

Keep in touch for more tips on how to keep your company safe from cybercriminals.