Law firms “more likely to pay cyber crooks” who lock their IT systems

Print This Post

28 February 2017


Security: could you be locked out of your systems?

More than a quarter of law firms that fall victim to ‘ransomware’ – software used by cyber crooks to block access to computer systems – end up paying £5,000 or more to retrieve their data, according to research.

The survey, of 250 law firms and 750 other UK businesses that have had a ransomware problem, found that legal victims were more likely to pay crooks to access blocked data than those in the three other sectors polled – retail, leisure and hospitality, and banking and insurance.

The survey showed that at 88% of law firms hit by this kind of attack, systems went down for a week or more.

The effects of a ransomware attack was “almost instant” at two-thirds of firms (68%), with “data systems going from fully functional to essentially useless within seconds and minutes”.

A third of law firms (33%) lost access to their data for more than a month, while 14% said it was “unrecoverable”.

A third of firms could not estimate the overall cost to their business of the attack, describing it as ‘unquantifiable’, while 53% reckoned it had cost between £1,000 and £2,000 a day in lost revenue, due to data systems being down.

The survey was conducted by cloud service specialists Timico and data protection provider Datto.

Andrew Stuart, managing director of Datto EMEA, said law firms needed to be aware that ransomware attacks were “not usually random”.

Mr Stuart went on: “These are generally intelligent people who set up businesses to make money by targeting people. They are looking for the firms most vulnerable to this kind of attack.

“It is terrifying that on the Dark Web you can buy a ransomware business and all you need is a list of firms to target.

“Law firms are very reliant on their reputations, and more reliant than others on their IT systems because everything goes through the computer – every letter, every transaction.

“They have to keep to tight deadlines to satisfy their clients and ultimately keep their reputations. Law firms are more likely to pay out because of all these reasons.”

Mr Stuart said he suspected that some law firms had made “much higher” payments than £5,000 to ransomware crooks. “Firms don’t want their clients to know that their systems have this infection and that they are vulnerable.”

However, Mr Stuart advised law firms not to pay, saying he knew of examples where money was paid and either nothing happened or a ‘key’ was forwarded to them to unlock their systems which did not work.

He added that law firms should invest in security products which enabled fast recovery from ransomware attacks, and on educating their workforce on all types of cyber-attack.



Leave a comment

* Denotes required field

All comments will be moderated before posting. Please see our Terms and Conditions

Legal Futures Blog

Preparing for the GDPR – What do you need to know right now?

Craig Forsyth

On 25 May 2018, the EU General Data Protection Regulation (GDPR) comes into force. That might seem like a long time, but that’s just over 100 days away at the time of writing. Actually, GDPR was adopted back in April 2016, May 2018 is the end of the two-year grace period. The GDPR brings with it a whole host of changes, and the penalties for non-compliance are higher than ever, either 4% of your annual turnover or £20m, whichever is higher. But how do you prepare? What do you need to change first? Where do you even start?

February 19th, 2018