Atlas Cloud, which provides IT services to the recruitment and legal sector, publishes research today (19 September) showing that almost three-quarters of UK-headquartered law firms have at least one employee password on the dark web.
Of the 5,140 firms audited, 72.2% had one or more instances of employee username and password combinations evident in lists circulating on the dark web. Perhaps more surprisingly, in total, Atlas Cloud found just over one million (1,001,313) passwords relating to firms in the study. This averages out at 195 password combinations per firm or or 1.27 per individual.
The UK-based company, which works with law firms including Ward Hadaway, audited the firms for breached passwords, phishing protection and email hijack protection. They also assessed alignment with the UK Government’s Cyber Essentials programme, which covers a range of defence mechanisms.
The news comes after a recent study revealed successful cyber-attacks against UK law firms rose 77% in the past year.
Cybercriminals use username and password information to enter a firm’s IT systems, looking to gain access to valuable information or intercept a transaction. Pete Watson, CEO of Atlas Cloud, said: “The sheer volume of password combinations available to criminals is a stark reminder of the threat that cyber poses to a firm. You can minimise this risk by applying multi-factor authentication on your systems, which adds an additional one-time authentication token, but criminals have been known to find ways around this too.
“It’s circumvented by tricking users to do something. That means the only true way to eliminate this threat is ensuring everyone representing your firm has a strong awareness of the tactics criminals are using today.”
DMARC, an email authentication protocol that helps protect email domains from unauthorized use, has been implemented by less than half (46.2%) of firms, according to the research. A hijacked domain would allow an unlawful actor to send emails that appear to come directly from the firm, opening up numerous opportunities for exploitation.
Watson said: “DMARC is essential in this sector. While it’s essentially a policy that you just switch on, doing so could cause operational disruptions. Firms usually start with a simple analyser tool to eliminate any risk to billable time.” He added: “Thankfully, most firms I speak with are either compliant or working towards it.”
The study also assessed alignment with a Government-backed scheme called Cyber Essentials. It found fewer than one in seven firms (14.7%) were certified as having achieved the nationally recognised minimum level of protective measures. Researchers stressed this doesn’t necessarily mean six in seven firms don’t have these factors in place; however, Cyber Essentials is recommended as part of Lexcel accreditation and is required for all public sector case work.
Finally, the research also revealed the industry’s adoption of specialised phishing protection technologies. It found at least half (53.1%) of firms employ a solution to filter out emails suspected as impersonation, a tactic that standard ‘spam’ filters aren’t able to recognise. The research wasn’t able to validate for sure that the remaining 46.9% of firms don’t employ such technologies but, given the volume that they were able to validate, the figure offers a warning to firms that don’t have a solution in place.
According to Official UK statistics, phishing is the number one cause of breach (Cyber Security Breaches Survey, 2024) and has been for many years.
caroline@legaltechnology.com