3 September 2026LANTEK Computers
Most businesses can absorb losing a day’s work. A legal practice occupies a different position, for three reasons that compound.
The file is the work product, and it cannot be recreated from memory. The information in it is confidential in a way that carries professional consequences beyond POPIA. And the practice routinely handles other people’s money, in amounts and on timelines that are visible to anybody reading the correspondence.
That third point is why legal and conveyancing practices are targeted specifically rather than incidentally.
The risk that costs the most money
It is not ransomware. It is a payment going to the wrong account, and the mechanism is almost always email.
Somebody gains access to a mailbox, either in the practice or at the other end of the transaction. They read quietly for a while. They learn the amounts, the parties, the expected dates and how the firm writes. Then, at exactly the right moment in a real thread, banking details arrive with a plausible explanation for the change.
Every check on the sender passes, because the sender is genuine. The amount is correct. The timing is expected. The client, who has never done a transfer of this size before and does not know what is normal, follows the instruction.
The full anatomy is in how business email compromise actually works, and the property specific version in the property transfer fraud that starts inside a real email thread.
The control that interrupts it is procedural rather than technical, and it is the single most valuable thing on this page. Banking details are never accepted or communicated by email alone. They are confirmed by telephone, on a number held before the transaction began. Told to the client at the outset, in writing, so that when a change arrives they already know to disbelieve it. Applied without exception, including when a partner is the one asking.
It is unglamorous, it costs nothing, and the exception is always the one that costs.
Confidentiality is a professional obligation before it is a POPIA one
Legal privilege and the practice’s duties to clients existed long before POPIA, and they set a bar that is in some respects higher. POPIA then adds its own requirements on top, and the two overlap rather than replace each other.
Practically, for the practice, that means a few things beyond the general obligations described in what POPIA requires from a business with no IT department.
Access should follow the matter, not the building. Not everybody in the practice needs every file. This is uncomfortable to implement in a small firm where everybody helps with everything, and it is still worth doing for the matters where it counts.
Correspondence is part of the file. A great deal of the substance of a matter lives in mailboxes rather than the document system. Whatever protects the file needs to cover mail, and mail is also the thing most likely to be attacked.
Retention is a decision, not a habit. Practices tend to keep everything forever. There are good professional reasons to keep matters for a long time, and they are not the same reason as never deciding. Information held with no current purpose is pure exposure.
The Legal Practice Council sets its own requirements on practices, and those change. We are not quoting a rule here, because a citation without the source in front of us is worse than none. Check the current position with your professional advisers, and treat anything an IT provider tells you about LPC rules with the same caution.
Where practices are most often exposed
From what we see, in rough order of frequency.
No multi-factor authentication on mail. The single highest value fix, and still commonly absent. Why it is not optional covers the objections.
The practice management data on somebody’s desktop machine. Common in smaller firms, and it means the practice depends on one computer being switched on, and that computer is usually outside the backup.
Documents in personal cloud accounts. A fee earner working from home puts a matter in their own storage because it is convenient. Now client files sit in an account the practice does not control and cannot recover.
Everybody an administrator. Makes the practice run smoothly and means any single compromise reaches everything.
Backups nobody has restored from. Universal rather than legal-specific, and the consequences here are worse. Test it.
WhatsApp as a matter channel. Instructions and documents move through it because clients prefer it. Worth deciding a position on deliberately, rather than having one by default.
What a practice should actually have in place
Not an exhaustive list. The things that would change the outcome.
Multi-factor authentication on every mailbox. The telephone verification rule for banking details, in writing, told to clients. Alerting on inbox forwarding rules, because that is the fingerprint of a compromise. Backups that somebody has restored from, covering both the document system and mail. Access that reflects who is on the matter. Encryption on laptops that leave the office. And a named person who owns the decision on the day something looks wrong, per the first 24 hours.
The conversation worth having with your clients
This is the part practices tend not to think of as IT, and it is where the leverage is.
Tell the client at the start of the matter, in writing, that your banking details will never change, that any message saying otherwise is fraudulent, and that they must telephone a number you give them before transferring anything. Repeat it in the letter that accompanies the invoice.
Some practices worry this looks alarmist. In our experience clients read it as competence, and it is the intervention most likely to stop the loss, because the client is the one at the keyboard when it matters.
What we do for the sector is on Legal Services, with the underlying pieces on Cybersecurity and Backup and Disaster Recovery. If you would like to know whether any of your practice’s addresses are already circulating, the free dark web scan answers that.