In a recent news update, it has been reported that Marks & Spencer has said that the damaging cyber attack over the Easter weekend was caused by “human error” and will likely cost the company around £300 million, with the aftereffects still ongoing.
According to one news article published on ITV.com, Chief Executive Stuart Machin said:
“We didn’t leave the door open, this wasn’t anything to do with under-investment.”
“Everyone is vulnerable. For us, we were unlucky on this particular day through some human error.”
Source – Marks & Spencer blames ‘human error’ as cyber attack set to cost £300m
Why a Cyber Security Audit is Vital
These cyber-attacks are becoming more prevalent, and law firms are one of the most targeted victims due to the vast amount of valuable data they hold on to. We have highlighted these concerns in previous articles, warning firms of their obligations and the consequences of failing to meet regulatory expectations.
Only recently, the Information Commissioner’s Office (ICO) fined a Merseyside-based law firm £60,000 following a cyber-attack that led to highly sensitive and confidential personal information being published on the dark web. Read more about it here: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/04/law-firm-fined-60-000-following-cyber-attack/
Download our Cyber Security Audit Checklist:
We have designed a downloadable checklist to help firms undertake a cyber-security audit, which is one of the most invaluable exercises a firm can take. Understanding the threats your law firm’s data faces, not just due to cyber-criminal attacks, is vital. Click the link below to access your free checklist, which is designed to help your firm perform a Cyber Security Audit and identify threats such as:
- Malware and hacking attacks – being aware of external threats is vital to data security. Business Technology for law firms is constantly evolving, and attackers are resorting to sophisticated techniques to compromise business data security.
- Ransomware – Law firms can hold some highly sensitive information, and for this reason, this type of malware has garnered popularity in recent years. Law firms should be aware of this potential risk to their client’s data.
- Denial of service attacks – the rise of IoT devices saw a dramatic rise in botnets. Denial of service attacks are now more widespread and dangerous than ever. If your business depends on uninterrupted network service, you should definitely assess risks associated with loss of service.
- Malicious insider threat – one of the biggest threats to a law firm’s data is its own employees or third-party vendors. Data can be easily leaked or misused and, unless you have specific monitoring tools in place, it can be hard to detect.
- Non-Malicious insiders – another risk group is the careless or uninformed employee, as not all insider attacks are done out of malicious intent. Data can be leaked unintentionally through errors such as forgetting to lock devices which contain sensitive information. Other common errors include downloading attachments or clicking links from suspicious email addresses or visiting unauthorised/malicious websites from the firm’s network. – this includes remote workers, see next;
- Remote–working – the COVID-19 crisis and the obligated lockdown forced firms into a remote-working culture that many were not used to. Whilst there are some proven advantages, one of the biggest disadvantages is that remoteness can easily become carelessness in regard to cyber-security. To address this, employees need to be made aware of just how easily information can be obtained and the means by which they can protect themselves and their firms. Most employees will be aware of recent high-profile cyberattacks, so the reality of the recent M&S hacking should hold relevance when explaining the dangers.
- Personal Devices – Allowing staff to use personal devices (sometimes referred to as BYOD – bring your own device– can increase flexibility and productivity (such as personal laptops or phones with access to email systems), but it also introduces security risks, especially if those devices are not encrypted, lack proper security software, are shared with family members, connect to unsecured networks, are not covered by company monitoring tools or policies.
- Natural disasters and physical breaches – whilst this would be a rare occurrence, the consequences of suffering such a threat can be devastating. Therefore, it should be included in a plan to cover the loss should it happen.
Download Free Checklist Here
Once you have assessed the risks associated with possible threats to your law firm’s data, you will need to examine any existing security controls already in place, address those that need improving and implement processes that are missing. For example, you could consider measures such as:
- Firewall and anti-virus software
- Anti-spam filter
- Access Control – assess privilege users
- User activity monitoring – User activity monitoring tracks employee activity and can protect against insider threats
- Employee security training and awareness
- Ensure security measures such as multi-factor authentication (MFA) as best practice
- Complete regular data backup
- Server security
- Ensure your firm’s PI insurance includes Cyber security cover
If you want to ensure you are meeting your obligations or require us to assist in completing a Data Protection Audit, Regulation and Compliance Office can help.
Our UK GDPR And Data Protection Auditing Services
Our UK GDPR and Data Protection Audit will provide the firm’s management with the confidence of knowing that it is compliant with the requirements of the regulation and can demonstrate such compliance. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these.
The following key areas will be considered as part of the audit:
- All policies to ensure they are up to date with the latest regulations and legislation.
- Data Retention approach and management
- System security
- Data storage processes
- Internal
- External arrangements
- Data management control
- Data Portability
- Cyber Crime Protection and Awareness
- Remote working management
- Terms and Conditions
- Data Controller/Processor arrangements and agreements
- Contracts
- Customer Notices
- Internal systems and controls
- Staff Notices
- Reporting
- Breach Management
- Breach Storage
- Subject Access Request Management
- ICO Reports and Engagement
A full report will be issued to the firm, which will be followed up with a discussion of any recommendations and actions that are made. We will identify any issues or concerns along with knowledge gaps and provide solutions and proposals to rectify these. For detailed information on this service and costings, download our brochure.
Get in Touch
To ask any questions about Regulation and Compliance Office and how we can support your Law Firm, please call us on 0203 985 8550, complete the online enquiry here, or email us at info@regulationandcomplianceoffice.co.uk
