Miller Insurance

<section><section><section><p>This Practice Note considers the cyber threats facing law firms, the role of cyber insurance, and the importance of effective cyber risk assessment and incident preparedness. It includes examples of cyber attacks affecting law firms and covers key cyber risks and vulnerabilities, the role of cyber insurance and cyber risk assessment and preparedness.</p><p>Law firms are attractive targets for cyber criminals. They hold large volumes of sensitive, personal and confidential information and frequently manage substantial sums of money.</p><p>The professional services sector continues to see a rise in the frequency, sophistication and severity of cyber incidents. Specific targeted attacks and sophisticated attacks created with artificial intelligence (AI) tools mean that it can be difficult to spot a phishing email or spoof call or message. Security technologies implemented some time ago may be vulnerable to AI-assisted attack. For law firms, there can be significant consequences, including financial loss, business interruption, regulatory scrutiny, reputational harm and loss of client trust.</p><p>For more information on law firm vulnerabilities, see Q&A: What cyber risks do professional services</p></section></section></section>

<section><section></section><section><p>This Q&A considers the cyber risks facing professional services firms, the main threats and consequences of cyber attacks, and practical measures, including appropriate insurance cover, to strengthen cyber resilience.</p><p>Professional services firms are a prime target for cyber criminals. Law firms, insurance brokers, accountants, consultants and other advisory businesses routinely hold large volumes of confidential, commercially sensitive and financially valuable information. They also sit at the centre of trusted business relationships, payment flows and high-value transactions. That combination makes them especially attractive to threat actors. Law firms, insurance brokers, accountants and consultants face exposure to phishing, ransomware, business email compromise, insider threats and third-party supplier incidents.</p><p>Cyber risk in the sector is not limited to opportunistic phishing emails or isolated malware incidents. The threat landscape includes ransomware, business email compromise, supply chain compromise, cloud misconfiguration, credential theft, insider activity and attacks enabled by artificial intelligence. For many firms, the question is not whether they will face a cyber incident, but when they will face</p></section></section>