Law firms increasingly susceptible as targets for cyber crime
updated on 15 April 2025
Reading time: two minutes
Law firms are becoming prime targets for cybercriminals due to the large quantities of sensitive client data they hold. Despite 97% of firms prioritising safety from cybercrime and fraud, according to the Law Firm Benchmarking 2024 report, only 32% of these firms provide regular training to their staff.
The legal industry was named one of the worst-performing sectors for data breaches last year, following law firm Hayes Connor’s analysis of data from the Information Commissioner's Office. The analysis revealed that nearly 86% of incidents in the legal sector involved breaches of basic personal identifiable information, including sensitive economic and financial data.
Despite the growing threat to cybersecurity, law firms are said to lack adequate cybersecurity measures. The report, which was conducted by global professional services firm Crowe, also found that 60% of firms cited a lack of cybersecurity awareness at board level as a significant concern. In addition, in 2020, the Solicitors Regulation Authority found that 20% of law firms it visited had never provided specific cybersecurity training.
Neglecting data security which can cause a data breach can lead to costly repercussions. According to technology company IBM, the global average data breach cost in 2024 was £3.7 million, a 10% increase from the prior year and the highest total ever.
Cybercrime can also impact a firm’s reputation. Partner in forensic services at Crowe, Tim Robinson, said: “Clients rely on law firms to protect their data and confidentiality. A cyber-attack can quickly undermine this trust and form cracks in hard-earned relationships.”
Robinson also noted that cyber safety is increasingly important due to the rise of AI because “AI-enabled cyber-attacks can take a number of forms, including phishing emails and more recently deepfakes and adapted malware”.
Legal director at Hayes Connor, Richard Forest, highlighted proactive measures firms must take, “such as encryption, multi-factor authentication and regular security audits. Also, implementing comprehensive data protection policies and providing regular training for staff on cybersecurity best practices are essential steps in mitigating the risk of data breaches”.
