Law firms hold client files, financial records, court strategies, commercial intelligence, and personal information for hundreds of individuals and businesses. They're also frequently smaller organisations with less IT infrastructure than their clients. Attackers know this. Here's what NZ legal practices are up against.
In 2022, the Law Society of New Zealand issued a warning to member firms following a series of cyber incidents targeting NZ legal practices. The incidents included email compromise attacks targeting client settlement payments, ransomware encrypting client file management systems, and a targeted attack on a firm involved in high-value commercial litigation where confidential strategy documents were exfiltrated.
Why Law Firms Are Specifically Targeted
Settlement payment interception: Property settlements, business sale transactions, and litigation settlements involve large wire transfers. Law firms are regularly in the flow of these payments — holding client funds in trust and disbursing to multiple parties. A compromised email account or a successful business email compromise targeting a firm's trust accounting process can redirect settlement funds to an attacker's account before anyone realises something is wrong.
Commercial intelligence: A law firm acting on a merger and acquisition knows the target company, the transaction structure, the price, and the timeline — weeks or months before any public announcement. This is market-sensitive information with significant financial value. Nation-state and financially motivated attackers have specifically targeted law firms involved in M&A transactions to obtain insider information.
Legal professional privilege doesn't protect against hackers: Client communications with legal advisors are privileged — but only from compelled disclosure. If those communications are stolen via a cyber attack, the legal privilege doesn't prevent the attacker from reading and using them.
The Regulatory Environment
Law firms have obligations under the NZ Privacy Act 2020 to protect client personal information and to notify the Privacy Commissioner and affected individuals of any notifiable privacy breach. The Law Society's Practice Guidelines require appropriate security measures for client information. Firms handling client trust funds have additional obligations under the Lawyers and Conveyancers Act.
A cyber breach at a law firm that exposes client information and compromises trust funds isn't just a business problem — it's a regulatory, professional disciplinary, and liability event.
The Non-Negotiable Controls for Legal Practices
For NZ law firms, Optimyze recommends as an absolute minimum: Microsoft 365 with MFA enforced on all accounts, DMARC at p=reject to prevent email spoofing, SentinelOne EDR on all firm endpoints, immutable backup of the practice management system and all client files, payment verification procedures requiring verbal confirmation of any trust payment disbursement, and regular phishing simulation training for all staff including partners.
For firms handling high-value transactions or commercially sensitive matters, additional controls — email encryption for sensitive communications, privileged access workstations for trust accounting, and network segmentation — provide a higher security baseline commensurate with the elevated risk.
A law firm's information security posture is part of its duty of care to clients. Client files, trust funds, and privileged communications all carry an implicit expectation of confidentiality that cyber attacks directly threaten — and that the firm is professionally responsible for protecting.
