Cyber Threats to Law Firms: Understanding the 2020 Threat Landscape

How Am I Being Attacked?

In 2020, ransomware is one of the most popular cyber-attack methods that cybercriminals use to target law firms. In a typical ransomware attack a target organisation’s network is penetrated by hackers, often by sending a phishing email (a fraudulent email sent by cybercriminals that mimics a legitimate communication from a trusted source, designed to steal information or deliver malware payloads) to individuals in the organisation that contains malware, or sometimes through exploiting a vulnerability in the organisation’s network.

The malware enters the network and the attackers conduct reconnaissance and further activity to achieve the right access they need to execute the ransomware. Once this is done, the target organisation’s network is encrypted and effectively unusable until either a ransom is paid or the organisation reverts to backups to bring the network back online.

Last year’s Norsk Hydro attack, in which operations at the large aluminium manufacturer ground to a halt when cybercriminals launched a successful ransomware attack on the firm, demonstrated the massive financial and operational impact ransomware can have on businesses, as the firm suffered millions of pounds in lost revenue and several months of operational turmoil. However, a relatively new trend for double-extortion ransomware attacks introduces a significant reputational threat to businesses, too.

Double-extortion first became a prominent tactic as a further method to make money from late-2019 onwards. In a double-extortion ransomware attack, the attackers threaten to leak stolen data onto the internet. The intention of double-extortion ransomware attacks is to shame target organisations into paying a ransom, even if the appropriate backups are in place to mitigate a traditional ransomware attack.

Many double-extortion ransomware attacks lead to sensitive data being publicised on social media. In mid-2020, there has been an increasing trend for the publication of screenshots of the stolen data by cybercriminals and security researchers. This means that often the first public indication that an organisation has been hit by ransomware will be stolen sensitive information appearing on social media.

Cyber Threats to Law Firms: How Do I Protect Myself?

The cyber threat to law firms is real, and it’s getting worse. Cybercriminals are actively targeting UK law firms with phishing emails and double-extortion ransomware attacks, and will continue to do so as long as they remain a successful (and lucrative) attack method. In order to protect your law firm, you need to understand the risks you face. By understanding these risks, you can take steps to address them.

Six Degrees is a trusted cyber security partner to prominent law firms throughout the UK and beyond. We understand the cyber threat to law firms, and we regularly advise our legal clients on the hostile digital landscape in which they operate.

Our whitepaper, Cyber Security for Law Firms, provides an overview of high-profile incidents that have taken place in the past twelve to eighteen months, types of cyber-attack, information on hackers and some examples of how regulatory bodies are focussing on the threat of cyber-attacks.

You can download our new Cyber Intelligence Report that covers the latest trends in ransomware attacks against the legal and accountancy sectors for free here. We’ve also created a handy infographic that provides the information you need to protect your law firm from ransomware attacks.

If you’d like support in enhancing your law firm’s cyber security posture, schedule a call by visiting https://hub.6dg.co.uk/legal-call