Cyber Incident and Data Breach Response for Law Firms

A law firm's systems hold two things that make it unusually attractive to criminals: other people's money, moving through client accounts in large, time-pressured transactions, and other people's secrets, in the form of case files, commercially sensitive deal documents and privileged correspondence. That combination is why solicitors' firms of every size — from high street conveyancers to City practices — are targeted far more often than their headcount would suggest. This guide sets out why firms are targeted, what the Solicitors Regulation Authority (SRA) expects of you, how the UK GDPR's breach notification duty fits in, and the practical steps a firm needs to take in the first hours and days after an incident. If cyber risk and incident response fall within your role, Learnsignal's CPD courses for legal professionals cover this and related compliance topics in far more depth than a single article can.

Why law firms are a prime target

Criminals target law firms for reasons that are specific to how the profession works, not just because firms hold personal data like any other business:

• Client money moves through the firm. Conveyancing completions, litigation settlements and probate distributions routinely involve six- or seven-figure sums passing through a client account on a fixed timetable — exactly the conditions fraudsters exploit with "Friday afternoon fraud," where a bogus email appears to change the bank details for a completion payment at the last possible moment.
• Case files are commercially and personally sensitive. M&A documents, litigation strategy, family court evidence and criminal defence material are all worth money or leverage to the right buyer, and a breach can hand an opposing party an unfair advantage in an active matter.
• Firms sit inside a chain of trust. A compromised firm can be used as a stepping stone into clients, counterparties, banks and other firms it regularly corresponds with, which raises the value of a successful attack well beyond the firm itself.
• Firms are often under-resourced for the risk they carry. Many practices, particularly small and mid-sized ones, run IT as a bolt-on rather than a core function, which is precisely the gap attackers look for.

The SRA's own thematic review of cyber security, which examined 40 firms that had been targeted in a cyberattack, found that those firms had collectively lost more than £4 million in client money, with roughly £3.6 million covered by insurance and around £400,000 paid directly by the firms themselves. The review also found that email manipulation, spyware, ransomware and unauthorised system access were the most common attack methods, and that 60% of firms identified their own staff's knowledge and behaviour as their single biggest cyber risk — yet a fifth of firms reviewed had never provided any specific cyber training at all (SRA, 2020).

What the SRA expects on cybersecurity

The SRA does not prescribe a single technical standard, but its thematic review and ongoing guidance set out clear expectations that firms are assessed against, both proactively and after an incident:

• Basic technical controls in place and maintained — firewalls, two-factor authentication, encryption of sensitive data, regular patching of software, and secure, tested backups kept separately from the live network so a ransomware attack can't reach them too.
• Training that reaches everyone, not just partners and IT — the SRA was explicit that cyber training needs to cover the whole firm, including support and administrative staff who are often the first point of contact for a phishing attempt.
• A written incident response and disaster recovery plan — stored somewhere accessible even if the firm's own systems are down, and tested rather than left on a shelf.
• A culture that encourages early reporting — the review specifically flagged that a supportive, non-punitive culture around reporting mistakes (a member of staff clicking a phishing link, for instance) leads to much faster containment than a culture where people are afraid to speak up.

On regulatory reporting, the SRA's Codes of Conduct require firms and individuals to report to the SRA any facts or matters they reasonably believe amount to a serious breach of the Standards and Regulations, and to do so promptly rather than let it wait. A serious cyber incident — particularly one involving client money, an inability to service clients, or a significant loss of confidential material — will usually meet that bar. The SRA's own guidance is explicit that this sits alongside, not instead of, the separate legal duty to report a qualifying personal data breach to the Information Commissioner's Office (ICO) under the UK GDPR and Data Protection Act 2018. In practice, most serious law firm incidents trigger both notifications, plus a call to the firm's professional indemnity insurer.

How the 72-hour GDPR duty applies to a firm

We cover the general mechanics of breach notification in detail in our UK GDPR and data protection essentials guide, so we won't repeat the full rule here — the short version is that a notifiable breach must be reported to the ICO without undue delay and, in any event, within 72 hours of the firm becoming aware of it, unless the firm can show and document that the breach is unlikely to result in a risk to people's rights and freedoms. Where the risk to affected individuals is high, they must also be told directly, in clear language, without undue delay.

What's specific to a law firm is what sits inside that 72-hour clock. Firms typically need to work out, at speed and often before full forensic details are known: which client files, matters or accounts were touched; whether any of that data is subject to legal professional privilege or a duty of confidentiality that makes disclosure decisions more delicate than in an ordinary business breach; and whether any conflicted or opposing parties in live litigation could be affected by, or could exploit, the breach becoming known. None of that changes the 72-hour deadline itself — it just means the assessment has to run in parallel with, not after, the wider incident response.

Practical incident response steps

The first few hours shape how well everything that follows goes. A workable sequence for a law firm looks like this:

• 1. Isolate. Disconnect affected devices and systems from the network (not necessarily powering them off, which can destroy forensic evidence) to stop lateral spread, and change credentials for any accounts suspected of compromise, starting with anything touching the client account or case management system.
• 2. Activate the plan and the right people. Trigger the firm's incident response plan, notify the Compliance Officer for Legal Practice (COLP) and Compliance Officer for Finance and Administration (COFA), and call the insurer's breach response line — many cyber policies include forensic and legal support that should be brought in early rather than after the firm has already tried to fix things itself.
• 3. Assess privilege and confidentiality implications. Work out, matter by matter, what was potentially accessed and whether it includes privileged material, undisclosed litigation strategy, or information subject to a court order or reporting restriction. This is a distinct step from the general data protection assessment because it can affect live cases directly — a breach that exposes litigation strategy to the other side is a different order of problem to one that exposes only administrative data. Our guide to legal professional privilege in practice covers how privilege is established and can be lost, which is directly relevant when working out what a breach has actually exposed.
• 4. Check for fraud, not just data loss. Many law firm incidents start as, or lead to, an attempt to redirect client money — a compromised mailbox used to send fake bank detail changes is the classic pattern. Where money has moved or is at risk, contact the receiving bank immediately to attempt a recall, as speed materially affects recovery chances.
• 5. Notify insurer, SRA and ICO as the facts require. Run the assessments in the table above in parallel, not sequentially, and document the reasoning behind each decision — including a decision not to notify — because that record is exactly what a regulator will ask to see afterwards.
• 6. Communicate with clients and, where relevant, the court. Affected clients need clear, honest, timely information, and in live matters the firm may need to tell the court or opposing counsel that a deadline or filing is affected. Silence, or a vague holding statement, tends to do more reputational damage than a direct explanation.
• 7. Recover and review. Restore systems from clean, tested backups; only reconnect once the entry point is closed; and run a proper post-incident review that feeds back into training and controls, in keeping with the non-punitive, learning-focused culture the SRA specifically wants to see.

Business continuity and client communication in a legal practice

A cyber incident at a law firm is also, immediately, a business continuity problem in a way it might not be for other businesses: court deadlines don't pause, limitation periods don't extend themselves, and a completion that doesn't happen on the agreed date can cause real financial loss to a client through no fault of their own. A workable continuity plan for a firm should identify, in advance, which matters have imminent deadlines and how they would be tracked and met if the case management system were unavailable; how fee earners can access urgent client information (redacted paper files, a secure offline copy, a manual diary) if systems are down for days rather than hours; and who has authority to communicate with clients, the court and the press, so a partner isn't improvising a public statement under pressure.

Client communication deserves particular care. Clients instructing a law firm are placing a high degree of trust in its discretion, and a breach that becomes public — or that a client hears about from someone other than the firm — damages that trust far more than the breach itself often does. Firms that get through an incident with their reputation largely intact tend to share a few habits: they tell affected clients directly and promptly rather than waiting for certainty on every detail; they explain in plain language what happened and what the firm is doing about it, without minimising or over-technical jargon; and they give a genuine point of contact for questions rather than a generic mailbox. Where fraud risk overlaps with the incident — for example, a client being separately targeted by a follow-up scam that references the breach — it's also worth pointing clients toward general awareness of the tactics involved; our fraud risk awareness guide for legal practice covers the common scam patterns clients and staff should be alert to.

Building the plan before you need it

Every element above works far better rehearsed than improvised. A short annual exercise — even a tabletop walkthrough of "a member of staff has just paid a fraudulent invoice, what happens next" — surfaces gaps in contact lists, insurer details and authority to make decisions long before a real incident does. Pair that with the basic technical controls the SRA has already told the profession it expects, and a genuinely blame-free reporting culture, and a firm moves from reacting to an incident to managing one.

Frequently asked questions

Does a law firm have to report every cyber incident to the SRA?

Not every incident, but the SRA's Codes of Conduct require firms and individuals to report facts or matters they reasonably believe amount to a serious breach of the Standards and Regulations. A cyber incident involving client money, a significant loss of confidential client data, or an inability to serve clients will usually meet that threshold, and the SRA expects prompt reporting rather than a delay while every detail is confirmed.

Is reporting to the SRA the same as reporting to the ICO?

No — they're separate duties that commonly apply to the same incident. The ICO notification is a legal requirement under the UK GDPR and Data Protection Act 2018 for a notifiable personal data breach, with a 72-hour deadline. The SRA report is a regulatory professional duty under the Codes of Conduct. A serious incident at a firm will often need both, plus notification to the professional indemnity or cyber insurer.

What makes privilege assessment different from a standard data breach review?

A standard breach assessment focuses on what personal data was exposed and the risk to the individuals concerned. For a law firm, the same incident can also expose privileged material or undisclosed litigation strategy, which can affect the outcome of a live case regardless of whether personal data was involved. That's why a firm's response needs a parallel, matter-by-matter review of privilege and confidentiality alongside the data protection assessment, not a substitute for it.

What's the single most useful thing a small firm can do to prepare?

Write down — before an incident, not during one — who to call first (insurer, COLP/COFA, IT support), where backups are kept and how they're tested, and who has authority to speak to clients and the court. Most of the damage in a poorly handled incident comes from those decisions being made for the first time under pressure, not from the technical failure itself.

Cyber incident response for a law firm sits at the intersection of data protection law, SRA regulation, professional ethics and plain business continuity — which is exactly why it rewards proper training rather than a one-off policy document. Learnsignal's CPD courses for legal professionals cover cybersecurity, data protection and the regulatory obligations that apply specifically to legal practice, so your team is ready to act — not improvise — when an incident happens.