Law firms are an obvious target for cybercriminals. They move large sums on predictable timetables, they hold confidential and privileged information, and their staff are used to acting quickly on email instructions. The SRA says law firms and their clients are attractive targets because transactions often involve large sums and firms control sensitive information for clients. It has treated cybercrime as a priority risk for some time.

What surprises many practice managers is how the insurance works after an attack. Your SRA-qualifying professional indemnity policy will respond to some of the consequences, and it can't exclude them. Other consequences, often the ones that hurt the firm most, sit outside PI and need a cyber policy, or crime cover, or both.

This guide explains that split for solicitors and law firms in England and Wales: what your PI must cover after a cyber incident under the SRA Minimum Terms and Conditions, what cyber insurance adds, how conveyancing payment fraud plays out, what the client money rules mean for your cash flow, and which questions underwriters will ask.

It sits alongside three other pages. For the whole practice insurance stack (PI, EL, office, D&O), see Solicitor Insurance UK. For renewing qualifying PI, see the SRA PI Renewal Checklist. For cyber insurance as a product for any business, see Cyber Insurance UK. This page covers the cyber question for law firms specifically.

Mesh'd Limited trading as Meshed is authorised and regulated by the Financial Conduct Authority under firm reference number 1033248. We work with the insurers on our panel and charge a flat 10% broker fee, with no admin add-ons. We review law firms' cyber and wider insurance arrangements and tell you where the gaps are. We don't publish prices, and named client quotes are off.

The short answer

• Your qualifying PI must still cover civil liability claims against the firm, including claims connected with a cyber attack. It must also cover your obligation to remedy a breach of the SRA Accounts Rules, defence costs that would have been covered anyway, and Legal Ombudsman awards. The SRA's Minimum Terms allow insurers to exclude cyber-related losses only so long as these core protections stay intact.

• A cyber policy covers the firm's own losses and costs: incident response, forensic IT, data restoration, business interruption, notification, extortion handling, and privacy liability.

• Crime or social engineering cover is for the firm's own money stolen by deception, such as a fake supplier invoice paid from office account.

• Most law firms need PI plus cyber, and many also need crime cover or a social engineering extension. The work is in making sure they fit together.

What your PI must do after a cyber incident

The SRA Indemnity Insurance Rules require authorised firms to hold PI that meets the Minimum Terms and Conditions (MTC). Clause 6.12 of the MTC deals with "cyber, infrastructure and Data Protection Law". It lets an insurer exclude liability in connection with:

• a cyber act (in the SRA Glossary, an unauthorised, malicious or criminal act, or the threat or hoax of one, involving access to, processing of, use of or operation of any computer system);

• a partial or total failure of any computer system;

• receiving or sending malware or malicious code;

• failure or interruption of core infrastructure (services from internet, telecoms or cloud providers);

• a breach of data protection law.

But any such exclusion must not exclude or limit the insurer's liability to indemnify the firm against:

• civil liability under clause 1.1, including the obligation to remedy a breach of the SRA Accounts Rules;

• defence costs under clause 1.2 that would have been covered even without the cyber event;

• awards by a regulatory authority under clause 1.4, which includes amounts paid on the recommendation of the Legal Ombudsman.

The SRA Glossary also says that, for PI purposes, an obligation to remedy a breach of the Accounts Rules is treated as a claim and as a civil liability, whether or not anyone has made a demand.

In practice, this means:

• If a client sues you because their completion money went to a fraudster after your systems were compromised, that's a civil liability claim. Your PI must respond, subject to the excess and the policy terms.

• If money is stolen from your client account and you have to replace it, that replacement obligation is treated as a claim under your PI.

• If the Legal Ombudsman recommends compensation for a client after an incident, that award falls under clause 1.4.

What PI is not designed to pay for is the firm's own loss. Forensic investigators, rebuilding systems, lost fee income while your case management system is locked, notifying clients, and money stolen from the office account are not civil liability to a client. Those are first-party losses, and that's where cyber and crime cover come in. The SRA's own thematic review found a firm whose PI didn't cover client losses from cybercrime, and the Minimum Terms now make clear that core client protection can't be carved out. The firm's own losses still can be.

One incident, which policy?

This table shows typical law-firm cyber events and where the money is likely to come from. Wordings vary, so treat it as a guide to the questions to ask, not a promise of cover.

The column that catches firms out is the last one. A PI excess on a large client money loss, plus a week of lost billing, plus forensic fees, can do more damage to a small practice than the claim itself.

Friday afternoon fraud: how a conveyancing attack unfolds

"Friday afternoon fraud" is the common name for payment diversion fraud in property transactions. The SRA found that email modification fraud was the most common type of cyber attack among the firms in its review, and the most common type of cyber incident reported to it, accounting for 68% of reports. Conveyancing transactions were the most common target, but fraudsters also went after negligence claims, litigation and probate matters.

Here is how a typical attack develops, and what each stage means for insurance. This is illustrative, not a real case.

Weeks before completion. An attacker gets into a fee earner's mailbox, often through a phishing email that collects their password, or into a client's personal email account. They set up a forwarding rule and quietly read correspondence. Nothing looks wrong. Insurance angle: underwriters will ask whether you use multi-factor authentication on email and whether you check for unusual forwarding rules. The SRA's own checklist asks whether you've checked whether your email account has been compromised with forwarder rules.

Completion week. The attacker knows the completion date, the amounts and the people involved. They register a lookalike domain, sometimes with a single character changed, such as a letter O replaced with a zero.

Friday, 2.30pm. The client receives an email that looks like it's from the firm, saying the firm's bank details have changed. Or the firm receives an email that looks like it's from the client or the other side's solicitor, giving new account details for the sale proceeds. Insurance angle: this is the moment controls matter. A call-back to a number you already hold, not one in the email, defeats most of these attacks.

Friday, 3.15pm. The money moves. If the client paid the fraudster directly, the client may later claim that the firm failed to warn them or that the firm's system was the source of the breach. If the firm paid out from client account on false instructions, the firm has a client account shortfall.

Friday, 4pm or Monday morning. Someone notices. Speed matters: contact the bank immediately, because the chance of recovering funds falls quickly. Insurance angle: notify your PI insurer of the circumstances and your cyber insurer of the incident, and call the cyber insurer's incident response line if you have one. Late notification is one of the easiest ways to create a coverage argument.

The following days. Under the SRA Accounts Rules, rule 6.1, you must correct any breach promptly on discovery, and any money improperly withdrawn from a client account must be immediately paid back in or replaced. That usually means the firm finds the shortfall from office money before any insurer pays. Under the SRA Codes of Conduct you must report serious breaches promptly to the SRA (paragraph 3.9 of the Code for Firms and paragraph 7.7 of the Code for Solicitors), and the SRA's cybercrime guidance recommends having protocols for when to report cyber incidents to the SRA, the data regulator, Action Fraud and the NCSC, depending on how serious they are. If personal data was compromised, you also need to consider whether to notify the data regulator within 72 hours (more below).

The aftermath. In one SRA case study, a firm replaced a large client account shortfall immediately from office account, which hit its cash flow hard. Its insurers ultimately reimbursed it, but the firm still lost its excess, and the client complained to the Legal Ombudsman, who required the firm to pay compensation.

The lesson for insurance: your PI may well respond to the client loss, but you still need cash to replace client money immediately, you still pay the excess, and you still pay for forensics and lost time. That's the gap a cyber policy (and good controls) is there to close.

Client money: why cash flow is the real risk

The SRA Codes require you to safeguard money and assets entrusted to you by clients and others (paragraph 4.2 of the Code for Solicitors, paragraph 5.2 of the Code for Firms). Rule 6.1 of the Accounts Rules then requires immediate replacement of any money improperly withdrawn from client account.

What this means in practice:

• The replacement duty doesn't wait for the insurer. Plan for how you would fund a shortfall in days, not months.

• Your PI excess matters more than you think. A higher excess may lower the PI premium, but it's what you'll pay out of office money on a client account loss. Choose it with a fraud scenario in mind.

• Cyber policies won't usually pay to replace client money. That's the PI's job under the MTC. Cyber pays for the response around it.

• Third-party managed accounts and Confirmation of Payee are mentioned by the SRA as ways to reduce exposure. Confirmation of Payee checks the account name against the account details before a payment is made.

• Office account losses are a different story. If a fraudster tricks your accounts team into paying a fake invoice or a fake "partner instruction" from office money, that isn't client money and the MTC don't apply. You need crime or social engineering cover (see Crime and Fidelity Insurance for how crime policies work). The SRA has noted accounts departments being targeted by "CEO fraud" impersonation.

Data breaches: confidentiality, UK GDPR and the regulator

Solicitors owe clients a duty of confidentiality. Paragraph 6.3 of the Code for Solicitors requires you to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. A cyber incident that exposes client files raises a professional conduct issue as well as a data protection one.

Under UK GDPR:

• Article 32 requires security appropriate to the risk, including, where appropriate, encryption, the ability to restore availability of data in a timely manner, and regular testing of security measures.

• Article 33(1) requires a controller to notify a personal data breach to the UK regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. The regulator was renamed the Information Commission; the legislation has used the new name since 30 September 2026. Older guidance, including the SRA's, refers to the Information Commissioner's Office.

• Article 82 gives anyone who suffers material or non-material damage from an infringement the right to compensation from the controller or processor.

The Data Protection Act 2018 sets the maximum fines (section 157): the higher maximum is £17,500,000 or 4% of total annual worldwide turnover for an undertaking, whichever is higher. UK policies commonly treat regulatory fines as uninsurable. A cyber policy will usually pay for legal advice, forensics and notification costs around a regulatory investigation, but don't assume it will pay a fine.

The 72-hour clock is one reason a cyber policy's incident response service is valuable to a law firm. A breach coach and forensic team can tell you quickly what was accessed and whether you need to notify, which is hard to do on your own over a weekend.

What the SRA expects, and what it doesn't

The SRA doesn't prescribe specific cyber controls. Its guidance says there is no one-size-fits-all model for managing cyber risk and that firms should decide how to protect themselves and their clients. It points firms to the National Cyber Security Centre, the government's Cyber Essentials scheme, and Law Society guidance.

But two general duties apply. Paragraph 2.1 of the Code for Firms requires effective governance structures, arrangements, systems and controls to ensure you comply with the SRA's regulatory arrangements and other legal requirements. Paragraph 2.5 requires you to identify, monitor and manage all material risks to your business. For most firms, cybercrime is plainly a material risk.

The SRA's practical guidance for reducing cybercrime risk recommends, among other things:

• a cyber-risk incident plan;

• a "no-blame" culture so staff report mistakes quickly;

• clear protocols for when to report incidents to the SRA, the data regulator, Action Fraud and the NCSC;

• training staff and raising awareness among clients, including telling clients you will never change your bank details by email.

The NCSC published an updated Cyber Threat Report for the UK legal sector in June 2023, explaining how UK law firms of all sizes can protect themselves from common cyber threats. Cyber Essentials covers five technical controls, and Cyber Essentials Plus adds independent technical testing. Neither is a legal requirement for law firms, but both are useful evidence when you buy cyber insurance.

For clients buying or selling property, HM Land Registry runs a free Property Alert service that sends email alerts when there is certain activity on a registered property being monitored. It's worth mentioning in client care materials for property clients.

What a cyber policy for a law firm should include

When you compare cyber options, check each of these points against how your firm actually works.

• Incident response with a 24/7 line. You need forensics, legal advice and a breach coach quickly, including at weekends.

• Business interruption. Covers lost fee income and extra costs while systems are down. Check the waiting period (how many hours before cover starts) and whether it covers outages at cloud providers you depend on.

• Data restoration. Rebuilding case files and systems.

• Extortion and ransomware response. Specialist negotiation and handling, within the law. The SRA noted that none of the ransomware-hit firms it met paid a ransom, and that paying gives no guarantee data will be released.

• Notification and credit monitoring costs. For clients whose data is exposed.

• Privacy and network security liability. Some overlap with professional indemnity here. Check how the two policies interact so neither insurer can point at the other.

• Social engineering and funds transfer fraud. Often a sub-limit. Check whether it covers office money only, and whether it requires a call-back procedure as a condition.

• Regulatory defence costs. Legal costs of dealing with the data regulator and, where the wording allows, other regulators.

• Reputational harm and PR. Useful for firms that depend on referral relationships.

• Bricking and hardware replacement. If malware renders devices useless.

• Cover for sole practitioners and consultants. If you use consultant solicitors on their own devices, check that they're insured persons.

For what cyber insurance generally excludes (known incidents, unsupported systems, state-backed attacks and fines), see Cyber Insurance UK.

Firm size changes the priorities

There's no single right setup. Here's how the priorities usually shift by firm profile.

Sole practitioner or two-partner firm. The biggest risk is a single fraud wiping out cash flow. Priorities: a manageable PI excess, a call-back policy for any change to bank details, multi-factor authentication on email, and incident response support you can call at once. Cyber options for very small firms vary, so speak to us about what the insurers on our panel can offer.

High street firm with a conveyancing department (around 5 to 25 people). Payment diversion and mailbox compromise are the main threats. Priorities: social engineering cover at a meaningful limit, business interruption with a short waiting period, documented payment procedures, staff training records, and a plan for replacing a client account shortfall immediately.

Commercial or litigation firm (25 to 100+ people). More data, more systems, more suppliers. Clients increasingly send security questionnaires and ask for cyber certificates. Priorities: higher cyber limits, dependent business interruption for cloud services, contractual liability checks against client terms, and a tested incident response plan.

Firms with personal injury, probate or private client work. Large settlements and estate funds are also targets. The SRA saw fraudsters target negligence claims, litigation and probate matters as well as conveyancing. Apply the same payment controls to every department, not just property.

What underwriters will ask

Most cyber proposals for law firms cover:

• Fee income and practice areas, especially the share of conveyancing and how much client money you hold.

• Email security: multi-factor authentication on all accounts, especially remote access and webmail.

• Payment controls: how you verify changes to bank details, who can authorise payments, and whether two people approve large transfers.

• Backups: whether they're offline or immutable, how often they're tested, and how long a full restore would take.

• Patching and supported software, including case management and accounts systems.

• Endpoint protection on all devices, including home and consultant devices.

• Training: phishing awareness, and how often it's done.

• Incident history: any attacks, attempted frauds or losses, even if no claim followed. Under the Insurance Act 2015 you must make a fair presentation of the risk, which includes disclosing every material circumstance you know or ought to know.

• Certifications such as Cyber Essentials or Cyber Essentials Plus, if held.

Clear answers usually mean a better conversation with the insurers on our panel. Gaps, such as no multi-factor authentication on email, can lead to exclusions or no offer at all.

Common mistakes law firms make

• Assuming PI covers "cyber". PI must cover civil liability to clients, but not your own forensics, downtime or office money losses.

• Buying cyber without checking the PI interaction. Overlapping privacy liability sections can lead to disputes about which policy pays.

• Setting the PI excess without a fraud scenario in mind. It's paid from office money.

• Ignoring social engineering sub-limits. A low sub-limit can be smaller than one fake invoice.

• Late notification. Tell both insurers promptly, even if you're not sure a claim will follow.

• Training only the property team. Fraudsters target litigation, probate and accounts staff too.

• Leaving consultants out. Consultant solicitors using their own devices and email can be the weak link.

How Meshed helps

We don't claim to place every type of solicitors' PI. What we do is review your arrangements as a whole: your qualifying PI terms against the MTC cyber provisions, your cyber policy (or the lack of one), your crime cover, and the excesses and sub-limits that decide how much an incident actually costs you. Then we tell you where the gaps are and what the insurers on our panel can offer for cyber and the covers around it.

Bring your current PI schedule and certificate, any cyber or crime policy, your fee income split by practice area, and a short description of your payment and email controls. If you are also renewing PI, use the SRA PI Renewal Checklist to line up dates. For the full practice stack, see Solicitor Insurance UK.

FAQs

Do solicitors need cyber insurance if they already have SRA-qualifying PI?

It isn't a legal requirement, but most firms benefit from it. Qualifying PI must cover civil liability to clients and your obligation to remedy Accounts Rules breaches, even after a cyber attack. It isn't designed to cover your own costs: forensics, data restoration, lost fee income, notification, or money stolen from office account. Cyber and crime cover fill those gaps.

Can my PI insurer exclude cyber claims?

Partly. Clause 6.12 of the SRA Minimum Terms and Conditions lets insurers exclude cyber, system failure, malware, core infrastructure and data protection losses, but not civil liability under clause 1.1 (including the duty to remedy Accounts Rules breaches), defence costs that would have been covered anyway, or regulatory awards such as Legal Ombudsman recommendations.

Who pays if client completion money goes to a fraudster?

It depends on what happened. If the firm paid out from client account on false instructions, you must replace the money immediately under rule 6.1 of the SRA Accounts Rules, and that obligation is treated as a claim under qualifying PI, subject to your excess. If the client paid a fraudster directly, any claim against the firm depends on whether you were at fault. Cyber cover usually pays for the investigation and response, not the lost funds.

Does cyber insurance cover money stolen from our office account?

Only if the policy includes social engineering or funds transfer fraud cover, which is often sub-limited. A standalone crime policy is the other route. Check the limit against the largest payment your accounts team could make on a single instruction.

Do we have to report a cyber attack to the SRA?

You must report serious breaches of the SRA's regulatory arrangements promptly under the Codes of Conduct, and a client account shortfall caused by fraud may well be one. The SRA recommends having protocols for when to report cyber incidents to it, the data regulator, Action Fraud and the NCSC. Decide case by case, and if in doubt take advice. Personal data breaches may also need notifying to the data regulator within 72 hours.

Will cyber insurance pay a fine from the data regulator?

Usually not. UK policies commonly treat regulatory fines as uninsurable. Cyber cover can pay for legal advice, forensics and notification costs around an investigation, and for third-party claims where covered.

Is Cyber Essentials compulsory for law firms?

No. The SRA doesn't prescribe specific controls, but it points firms to Cyber Essentials and NCSC guidance. Certification is useful evidence when you apply for cyber insurance and when clients send security questionnaires.

Can Meshed review our cyber cover alongside our PI renewal?

Yes. We'll review your cyber, crime and PI arrangements together and tell you where the gaps are. We don't claim to place every solicitors' primary PI programme, so we'll be clear about what we can and can't arrange through the insurers on our panel.

Talk to us

If you want a second pair of eyes on your firm's cyber exposure, speak to us. Bring your PI schedule, any cyber or crime policy, and a short note on how you handle bank details and payments. We'll tell you what the insurers on our panel will need and where your gaps are.

Mesh'd Limited t/a Meshed / Meshed Cover · FCA FRN 1033248 · flat 10% broker fee · Ltd, partnerships, and sole traders · no fake prices · Speak to us