SOC status:Duty analyst on shift
Sectors · Legal services
Solicitors, barristers' chambers and legal service providers hold other people's secrets and other people's money. We watch the estate, test it and help you answer the SRA, your PI insurer and your largest clients' security questionnaires.
SRALaw Society guidanceLexcelCyber Essentials PlusClient questionnaires
Two threats dominate. The first is payment diversion: business email compromise aimed at conveyancing and completion funds, increasingly with AI-generated voice pretexts purporting to be a partner authorising a transfer. The second is data extortion: ransomware operators such as INC Ransom and Qilin have run sustained campaigns against UK and EU firms, and document-management platforms — SharePoint in particular — are exploited at scale within days of a disclosure. Initial access is bought as often as it is earned: credentials to Microsoft 365 tenants purchased from initial-access brokers, then used quietly to read matters before anyone notices. Our weekly legal-sector report tracks the operators, the vulnerabilities and the defensive actions, in the order that matters.
What we watch for
Inbox rules, look-alike domains and voice pretexts aimed at the moment money moves.
Initial-access brokers selling M365 logins to ransomware affiliates who read before they encrypt.
SharePoint, DMS and file-transfer defects used to lift client-matter files without touching a workstation.
VPN and gateway vulnerabilities exploited faster than most firms patch.
Legitimate remote-management tools installed by a 'helpdesk' caller and used for hands-on-keyboard access.
IT providers and case-management vendors as the route into many firms at once.
How we help
Weekly report
Legal-sector risk continues to be driven by rising SRA-reportable breach numbers, the dominance of phishing and completion-payment fraud, and two actively exploited SonicWall SMA1000 zero-days that matter to firms using SMA appliances for remote access.
The legal-services vertical continues to be shaped by the NCSC Cyber Threat Report on the UK legal sector and by the accelerated cadence of intrusions against mid-market and boutique firms.
The legal vertical remains a high-value target for both organised criminal extortion crews and, in the top firms, state-linked espionage actors seeking privileged client material.
Coverage this period is dominated by the SharePoint deserialisation KEV entry (CVE-2026-45659) - operationally significant for the legal sector given the near-ubiquity of SharePoint and iManage for matter files, trust-account documentation…
The dominant collection theme this period is the convergence of edge-appliance exposure (Ubiquiti UniFi OS chain added to CISA KEV on 23 June) with sustained ransomware and pure data-extortion targeting of UK law firms which continues to attract NCSC, SRA and Law Society attention.
During the reporting period the principal observations were the continued INC Ransom group campaign against law firms - 20 victims claimed across 2026 to date including ten claimed in a recent 48-hour burst - and the Halcyon 200+ ransomware incident dataset that places the legal sector as the…
Questions
Firms of that size are exactly who the payment-diversion crews target, and a managed SOC costs a fraction of one diverted completion. SOC365 is priced on the estate we monitor, not on headcount tiers designed for banks.
Yes. Our virtual CISO service exists partly for this: the questionnaires, the evidence behind the answers, and the controls that turn a 'no' into a 'yes' before the next one arrives.
Call us. We help firms that are not clients on an emergency basis; an Incident Response Retainer simply guarantees the response time and removes the negotiation from the worst day.
Start a conversation
Tell us how matters, money and mail move through the firm and we will tell you where we would look first.