RUNNING LATE FOR YOUR PII RENEWAL? GET A FREE QUOTE NOW
RUNNING LATE FOR YOUR PII RENEWAL? GET A FREE QUOTE NOW
RUNNING LATE FOR YOUR PII RENEWAL? GET A FREE QUOTE NOW
RUNNING LATE FOR YOUR PII RENEWAL? GET A FREE QUOTE NOW
Client money, conveyancing files, litigation strategy, medical records, merger documents: UK solicitors hold some of the most sensitive data in the economy, and criminals know it. Understanding UK law firm cybersecurity statistics 2026 is no longer a task for the IT team alone. It sits squarely with partners, COLPs, COFAs and practice managers, because a single phishing email can trigger a data breach, a regulatory investigation and a professional indemnity claim in the same week.
This article draws on the latest official UK data, including the Department for Science, Innovation and Technology's Cyber Security Breaches Survey, the Solicitors Regulation Authority's thematic work on cybercrime, and published analysis of Information Commissioner's Office (ICO) breach reporting, to set out what the evidence actually shows about cyber risk in the legal sector. It explains what each statistic means in practice, where the data is dated or limited, and how cyber insurance fits into a firm's wider approach to risk management. Where a genuine 2026 figure exists, it is used and dated. Where the most recent authoritative figure is older, that is stated clearly rather than dressed up as new.
The government's Cyber Security Breaches Survey 2025/2026, published by DSIT in April 2026 and based on fieldwork carried out between August and December 2025, found that 43% of UK businesses identified a cyber security breach or attack in the previous 12 months. Prevalence was significantly higher among medium businesses (65%) and large businesses (69%) than among micro and small firms, a pattern that matters for law firms, since most English and Welsh practices fall into the small or medium bracket.
The survey does not isolate solicitors as a standalone category. Law firms sit within the "professional, scientific or technical" business grouping used in official statistics, alongside accountants, consultants and other professional advisers. Within that grouping, 85% of businesses said cyber security was a high priority for senior management, the second-highest figure of any sector after finance and insurance, and 41% had a board member with explicit responsibility for cyber security, again among the higher-scoring sectors. That suggests professional services firms, including solicitors, are more alert to cyber risk than the average UK business, even though awareness has not eliminated exposure.
Separately, the Solicitors Regulation Authority's thematic review of cybercrime remains the most detailed sector-specific study available. It examined 40 incidents reported to the SRA by law firms over a three-year period (2016 to 2019) and found that three-quarters of the firms visited had been the direct target of a cyberattack, with two larger firms reporting hundreds of attempted attacks every year. Collectively, more than £4 million in client money was stolen across the cases reviewed, of which around £3.6 million was recovered through insurance, leaving firms and their clients to absorb the remainder. This is historical data from a relatively small, non-random sample of 40 firms, so it should not be read as a current, sector-wide attack rate. Its value lies in illustrating the mechanics and consequences of real incidents rather than in providing a current prevalence percentage.
Analysis of ICO breach-reporting data by legal-sector commentators has placed the legal profession consistently among the ten most-affected sectors for reported personal data breaches, with the legal sector accounting for a single-digit percentage share of total incidents reported to the regulator in recent years. This is useful context for law firm data breach statistics, but it reflects reported incidents only; breaches that go undetected or unreported do not appear in the figures.
Law firms are targeted because of what they hold and how they move it, not because their defences are necessarily weaker than other sectors.
A typical conveyancing, litigation or corporate transaction involves:
The SRA's review specifically noted that law firms are attractive targets given the large sums of client and office money, and sensitive personal data, that firms hold and transfer, often without the same layered controls found in banks and other regulated financial institutions. Criminals exploit the trust placed in email during a transaction, particularly around completion dates, when a client is expecting to send or receive a significant payment and is primed to act quickly on an instruction that appears to come from their solicitor.
This is why law firm cyber risk cannot be separated from operational pressure. Fee-earners working under deadline, juggling multiple matters and relying on email as the primary communication channel create exactly the conditions that phishing and business email compromise are designed to exploit.
What is phishing, and how big a risk is it for law firms? Phishing is a fraudulent email, text or website designed to trick the recipient into revealing login details, transferring money or opening a malicious attachment. It remains, by a clear margin, the most common way UK organisations are compromised.
The Cyber Security Breaches Survey 2025/2026 found that phishing was experienced by 38% of businesses that identified any breach or attack, and was cited as the most disruptive type of incident by 69% of affected businesses and charities. Among businesses that experienced a breach, just over half (51%) experienced phishing only, with no other type of attack, a proportion that has been rising year on year. Looked at through the separate cyber crime lens in the same survey, phishing accounted for 93% of businesses that experienced any cyber crime, making it comfortably the dominant threat type facing UK organisations, including solicitors' practices.
For law firms, phishing typically appears in three forms:
1. Generic phishing: mass emails impersonating banks, couriers or software providers, designed to harvest credentials
2. Spear phishing: emails tailored to a specific fee-earner or matter, often referencing real case details gathered from a firm's own website or public court listings
3. Business email compromise (BEC): where a criminal either spoofs or actually compromises a solicitor's or client's email account and inserts fraudulent bank details into an ongoing transaction, most commonly at completion
BEC is particularly damaging for law firms because it exploits the exact moment client money is due to move. The ICO's own guidance to the legal profession has previously highlighted that the sensitivity of information handled by solicitors and barristers means the damage from a breach can be significant even where the number of incidents looks modest against a firm's total transaction volume.
Reducing phishing risk starts with the basics identified in the government's own survey data: up-to-date malware protection (in place at 81% of UK businesses), a clear staff process for handling suspicious emails (58% of businesses), and multi-factor authentication (47% of businesses, still a minority). Firms that have not yet closed these gaps are, statistically, behind sector-leading practice.
What happens when a law firm suffers a data breach? A data breach occurs whenever personal data is lost, stolen, altered or disclosed without authorisation, and it does not always require a sophisticated attack; misdirected emails and lost paper files are recurring causes in the legal sector.
Analysis of ICO reporting figures by legal-sector data breach specialists has found the legal profession ranked among the top six or seven most-affected sectors for reported data breaches in recent annual periods, with basic personal identifiable information involved in the large majority of legal-sector incidents reviewed. The same analysis identified data emailed to the wrong recipient and phishing as the two leading causes of breaches within the sector, and flagged that a significant minority of legal-sector breaches were reported to the ICO later than the 72-hour window set out under UK GDPR.
It is worth being precise about that reporting duty. Not every cyber incident has to be reported to the ICO. A personal data breach must be assessed against a specific legal threshold: notification to the ICO is required only where the breach is likely to result in a risk to the rights and freedoms of the individuals concerned, and it must generally be made within 72 hours of the firm becoming aware of it where that threshold is met. Where the risk to individuals is unlikely, notification may not be required, but the assessment itself, and the record of that decision, still needs to happen. This is a judgement call that benefits from a documented incident response process rather than an ad hoc reaction under pressure.
The SRA's thematic review adds a regulatory dimension specific to law firms: among the 40 firms it examined, nine had failed to report personal data breaches to the ICO when the law required it, and seven significant incidents had not been reported to the SRA itself, despite the SRA's own reporting obligations for solicitors. This points to a recurring weakness: firms often respond to the technical side of an incident reasonably well but under-invest in the regulatory and reporting steps that follow.
The practical costs of a breach extend well beyond any regulatory fine. They include forensic investigation, legal advice, client notification, credit monitoring for affected individuals, PR and reputation management, and the fee-earner time diverted away from billable work. The SRA review recorded one firm losing around £150,000 in billable hours after a cyber incident crippled its IT systems, a cost that never appears in a regulator's fine but is entirely real to the firm's bottom line. Sound law firm data protection practice, covering how personal data is stored, transmitted and disposed of, is the first line of defence against these costs, and it is a theme regulators consistently return to when reviewing legal-sector incidents.
How serious is ransomware for law firms right now? Ransomware encrypts an organisation's files and demands payment for their release, and while it remains far less common than phishing, its impact per incident is typically much higher. The most recent Cyber Security Breaches Survey found ransomware incidents affecting just 1% of UK businesses in the 2025/2026 reporting period, down from 3% in each of the two previous years. That is a genuinely low prevalence figure at an economy-wide level, but two points temper any reassurance. First, ransomware is heavily concentrated among larger and more data-rich organisations, a category that includes many established law firms. Second, when ransomware does hit, the consequences are disproportionate to its low frequency: encrypted case management systems, inaccessible client files, and, in the worst cases, a firm unable to complete transactions or meet court deadlines.
This is where business interruption becomes as significant as the breach itself. A firm that cannot access its systems for several days faces lost fee income, potential breach of client service level agreements, and reputational damage that can outlast the technical recovery. The SRA's review of legal-sector incidents specifically referenced ransomware among the methods used against firms, alongside spyware, viruses, email modification and denial-of-service attacks, underlining that law firms face a genuinely varied threat mix rather than a single attack type.
Operational resilience measures, such as maintaining offline or immutable backups, testing incident response and business continuity plans, and understanding how quickly systems can realistically be restored, are central to limiting downtime. Yet official data shows only 25% of UK businesses currently have a formal incident response plan in place, rising to 57% of medium businesses and 76% of large businesses. Many law firms, particularly smaller and mid-sized practices, sit in the gap where a plan exists in principle but has not been tested against a realistic scenario.
Does professional indemnity insurance cover cyberattacks? Not automatically, and this is one of the most common points of confusion among practice managers and COFAs. Professional indemnity insurance (PII) is designed to respond to claims arising from a breach of professional duty, such as negligent legal advice. A cyberattack or data breach may or may not trigger a PII claim depending on the specific circumstances and the policy wording; it is not a given that PII will respond to the direct costs of a cyber incident, such as ransom negotiation, system restoration, forensic investigation or a regulatory fine. This is why standalone or dedicated cyber cover exists as a distinct category alongside PII, and why reviewing exactly what a firm's current arrangements do and do not include is worthwhile rather than assumed.
The Cyber Security Breaches Survey 2025/2026 shows that cyber insurance uptake among UK businesses has grown gradually: 47% of businesses reported being insured against cyber security risks in some form, up from 45% the previous year, though only 10% held a specific, standalone cyber insurance policy rather than cover bundled within a broader package. Uncertainty remains widespread: 22% of businesses did not know whether they held any form of cyber cover at all, despite the survey being completed by the person identified as most responsible for cyber security within the organisation. Among organisations without cover, the most commonly cited reasons were simply not being aware cyber insurance existed (39%) and it not being treated as a budgetary priority (34%).
That awareness gap is a genuine insurance risk in its own right. A firm that assumes its general PII or office policy will absorb the cost of a ransomware attack, a business email compromise loss, or the expense of notifying thousands of affected clients may discover, only after an incident, that the cover was never designed for that purpose.
Cyber insurance for law firms typically sits alongside, rather than replaces, good cyber security practice. It cannot prevent a phishing email from landing in an inbox or stop a member of staff clicking a malicious link. What it can do is provide financial and practical support once an incident has happened, helping a firm respond, recover and meet its obligations to clients and regulators. Reviewing law firm cyber insurance arrangements is therefore best treated as one part of a broader cyber risk management strategy that also includes technical controls, staff training and incident response planning, not a substitute for any of them.
Legal Ex Plus, a trading style of Lex Insure Services Limited and authorised and regulated by the Financial Conduct Authority, provides cyber insurance for UK law firms and other professional practices alongside professional indemnity, management liability and related covers. Its cyber insurance is intended to help with data breach costs, ransomware-related losses, business interruption and the practical support firms need to meet regulatory obligations such as UK GDPR compliance following an incident. Details of what is included and how the cover works are set out on the Legal Ex Plus cyber insurance page.
The data above points to a consistent set of practical priorities for solicitors' practices of every size.
A working cybersecurity checklist for law firms:
None of these steps eliminates cyber risk entirely; no control, and no insurance policy, can offer complete protection against a determined attacker or a moment of human error. What they do is reduce the likelihood of an incident, limit its impact if one occurs, and put a firm in a stronger position when it comes to demonstrating to the SRA, the ICO and clients that reasonable steps were taken.
Phishing and business email compromise remain the dominant risks by volume, given their role in the majority of UK cybercrime. Ransomware and misdirected data are less frequent but carry a higher potential cost per incident, particularly where client money or sensitive case data is involved.
Phishing is the most prevalent form of cyberattack across UK businesses generally, cited in 38% of breaches identified in the DSIT Cyber Security Breaches Survey 2025/2026 and accounting for 93% of cybercrime experienced by UK businesses. Law firms are not tracked separately in this survey, but the SRA's own review found three-quarters of the firms it examined had been directly targeted.
The firm must assess the breach against the UK GDPR threshold for risk to individuals, notify the ICO within 72 hours if that threshold is met, consider whether affected clients need to be informed, and, for solicitors, consider the firm's separate reporting obligations to the SRA. Investigation, remediation and client communication typically follow alongside this regulatory process.
Not automatically. PII responds to claims arising from a breach of professional duty and may not cover the direct costs of a cyber incident, such as ransomware response, system restoration or regulatory fines. Firms should check their policy wording carefully and consider whether standalone cyber cover is needed alongside PII.
Because a cyber incident can create costs, forensic investigation, client notification, business interruption, and potential fraud losses, that fall outside standard professional indemnity or office insurance. Cyber insurance is designed to support a firm's financial and practical response to those specific costs.
Contain the incident, preserve evidence, assess whether the ICO notification threshold is met, consider SRA reporting obligations, notify your insurer promptly, and communicate with affected clients as appropriate. Having a documented incident response plan in advance makes each of these steps faster and more consistent.
Insurers generally look more favourably on firms that can demonstrate basic technical controls, staff training and a tested incident response process. Reducing the underlying cyber risk through the checklist above also reduces the likelihood of a claim and supports a stronger conversation with insurers at renewal.
The evidence base behind UK law firm cybersecurity statistics 2026 tells a consistent story: phishing dominates by volume, ransomware and data breaches carry disproportionate cost when they occur, and regulatory reporting is an area where firms of all sizes continue to fall short. None of this is unique to the legal sector, but the combination of client money, sensitive personal data and strict professional obligations makes the consequences more acute for solicitors than for many other businesses.
Cyber insurance will not stop an email attack landing in a fee-earner's inbox, and it should never be treated as a substitute for basic technical controls, staff training or an incident response plan. Used alongside those measures, however, it forms a practical part of how a firm manages the financial and operational fallout if an incident does occur. If your firm has not reviewed its cyber insurance arrangements recently, or is unsure whether your professional indemnity policy would respond to a cyber incident, it is worth taking a closer look at what your current cover actually includes. You can review Legal Ex Plus's cyber insurance options for UK law firms and request a quote at : legalexplus.com/pages/cyber-insurance.
The information provided is for general informational purposes only and does not constitute advice. While we strive to ensure the information is accurate and up-to-date, we make no representations or warranties of any kind, express or implied, regarding the accuracy, adequacy, validity, or completeness of any information on this site.