The technology problems that actually bite small law firms

A conveyancing matter is days from completion. The client gets an email that looks exactly like the last twelve — same signature, same matter reference, same turn of phrase — saying the client account details have changed. They send the money. Nobody notices until the other side asks where it is.

Other businesses lose their own money. A law firm loses client money, and that is a different order of problem: an Accounts Rules failure, a report to the SRA, a claim on the PII policy, and a client whose purchase has just collapsed. The attacker often does not need to break into your systems at all. They are frequently sitting in the estate agent’s mailbox, or the buyer’s personal webmail, reading a chain you are only one participant in.

Ask where a matter lives and the honest answer is: some in the case management system, some in a folder on the server, and the parts that actually matter in an email thread in one fee earner’s inbox. When they are on holiday nobody else can pick it up. When they leave, it leaves with them.

Two obligations collide here. You have to be able to produce the file — for a subject access request, a complaint to the Legal Ombudsman, a costs assessment, or a negligence claim brought years later. And you have to keep it for a very long time: six years as a working minimum, commonly fifteen or more for property, and wills and deeds effectively for a lifetime. Microsoft 365 will not do that on its own. Deleted items empty after 30 days by default, and a deleted mailbox is gone in 30. A retention obligation measured in decades, sitting on a default measured in days, is not a policy — it is a gap nobody has looked at.

There is a backup. It runs overnight and emails a report. Nobody has read the report in a year, and nobody has ever restored anything from it.

The SRA’s own thematic review visited 40 firms. All of them backed something up — and 15 of them kept their disaster recovery plan on the very systems the plan existed to recover. The other gap people miss: Microsoft does not back up your Microsoft 365. Microsoft keeps the service running; keeping your data is your side of the bargain. If an intruder deletes a SharePoint library, or a leaver empties a mailbox, then past the retention window it is simply gone.

The case management system is unavailable on the morning a bundle is due.

Most businesses that lose a day lose a day’s turnover. A firm that loses a day can lose a limitation date, miss a filing deadline or blow a court direction — and at that point it has stopped being an IT incident and become a negligence claim. It is also worth knowing that the standard ransomware playbook is to encrypt on a Friday evening, when nobody is watching. For a conveyancing practice, that is the worst hour of the week by some distance.

A paralegal has a witness statement to summarise and forty minutes to do it in. There is a free tool one click away that will do it in thirty seconds.

The SRA has not banned AI and there is no good reason it should. But the solicitor stays responsible for the work, confidentiality still applies, and the moment client-identifiable material goes into a consumer service you have engaged a third-party processor with no data processing agreement and no idea what happens to the text afterwards. The realistic risk is not a dramatic leak. It is that when a client or your PII insurer asks whether client data has been put into AI tools, nobody in the firm can answer.

Cyber Essentials for the legal aid contract. An information management section for Lexcel. A lender’s panel questionnaire. And now the PII renewal is asking whether you have MFA.

These used to be paperwork exercises a COLP could absorb. They are now technical assertions that somebody has to be able to evidence — and increasingly they are pass/fail rather than best endeavours. Four dates worth having in view:

• Since 1 October 2025, holding a criminal legal aid contract requires a valid Cyber Essentials certificate.
• From 26 April 2026, Cyber Essentials v3.3 makes missing MFA on cloud services an automatic fail — as is failing to apply critical and high-risk updates within 14 days.
• Lexcel or SQM remains a condition of LAA work, and information management is one of the assessed sections.
• PI insurers increasingly ask cyber questions at renewal, and the answers affect the terms you are offered.

There is a box in the corner of the back office. It runs the practice management system, it holds the shared drives, and it has been there since before the current partner joined.

It is the single point of failure for the entire practice, it sits in the same building as any fire, flood or burglary, and if the operating system has gone out of support it will fail Cyber Essentials on its own account. It is also precisely where ransomware wants to land, because every workstation in the office has a drive mapped to it.

Four people, one shared login for the portal everybody needs, and the secretary knows the partner’s password because otherwise nothing would get done on a Friday.

You lose attribution. When something goes wrong — a file altered, a payment authorised, a document sent to the wrong party — you cannot say who did it, and in a regulated practice that is precisely the answer you most need to have. Shared accounts also cannot be properly protected with MFA, and they are never removed when someone leaves. Cyber Essentials fails you on this, and it is right to.

The costs draftsman. The outsourced cashier. The typing service. The agent covering the hearing. Chambers. The estate agent on the other side of the transaction.

Confidential material moves between all of them constantly, mostly by email, and their security is not something you control. The NCSC lists supply chain compromise among the principal threats to the legal sector for exactly this reason: an attacker does not need to get into your firm if they can get into a smaller supplier that emails you every day. And a property transaction email chain routinely includes people whose mailboxes you have no visibility of whatsoever.