Law firms face severe cyber threats

Law firms are now under significant threat from cyberattacks, according to Shieldpay, a prominent payments platform. A critical flaw in PHP, the programming language underpinning a large portion of the World Wide Web, has heightened concerns across the legal sector. Sophie Condie, CEO of Shieldpay, emphasised the vulnerability, stating that around 70% of law firm websites utilise PHP, with those relying on WordPress being particularly at risk.

With many legal practices visible in the market due to their high-profile transactions and connections to significant brands, the risk of cybercriminals targeting them has surged. Condie explained, “Law firms of any size are at risk due to the work they do, surrounding complex transactions, often very visible in the market through both their own and their clients’ brand profiles.” The perception of law firms as trustworthy institutions handling substantial financial transactions and sensitive client information makes them appealing targets.

Research from the National Cyber Security Centre suggests that a staggering 75% of UK law firms have encountered a cyberattack. Smaller firms, often lacking up-to-date IT infrastructure, may be especially vulnerable to these threats. Condie noted, “This PHP vulnerability is likely to lead to a rise in attempted attacks on law firms in the coming days and weeks, and staff need to stay vigilant.”

The potential consequences of a successful cyberattack can be dire. If hackers gain access to a law firm's website, risks include data breaches and financial scams. Condie cautioned, “Hackers could access client information through unsecured contact forms, leaving a firm open to a damaging data breach.” Moreover, the ability to misuse a firm’s domain could enable cybercriminals to send misleading emails that appear to originate from the firm itself, potentially containing fraudulent payment or wire instructions.

To mitigate these risks, Condie advises firms to focus on cybersecurity measures, stating, “The best way to protect against that, is to speak to your Infosec or IT team, and your payments team if you have these in-house.” For smaller firms without dedicated IT support, she suggests obtaining guidance from a regulated and accredited payment provider. The warning from Shieldpay serves as a critical reminder for all law firms to reassess their cyber security protocols in light of this developing threat.