What happened, who was affected, and what we can learn…
February brought a surge in breaches within professional services, with notable concerns emerging in the legal sector. A major leak affecting millions emerged in public reporting, alongside enforcement action against a law firm for ransomware-induced data exposure.
Legal Sector-Wide Breach
Date Reported: 5th February, 2025
No. of UK Individuals Affected: Approximately 7.9 million.
Data Exposed or at Risk: Personal and financial details, including email addresses, banking/financial data, health/official documents.
ICO Response: Trend flagged via sector-wide data; no individual ICO enforcement yet.
Summary: Analysis of ICO data revealed a 39% rise in data breaches in the legal sector (Q3 2023–Q2 2024), affecting nearly 8 million individuals—often stemming from phishing, human error, and accidental data sharing.
Commentary: The legal profession handles sensitive PII daily; these numbers underscore systemic vulnerabilities, particularly in email/insider security protocols. Firms must invest in anti-phishing tech and reinforce awareness training now.
DPP Law Ltd.
Date Reported: 14th February, 2025 (ransomware incident).
No. of UK Individuals Affected: Undisclosed (client data compromised).
Data Exposed or at Risk: Client PII via ransomware attack.
ICO Response: £60,000 fine for UK GDPR failings (Articles 5 and 32); also failed to report quickly (Article 33).
Summary: The firm was hit by ransomware, exposing client-sensitive data. ICO determined DPP Law lacked appropriate technical/organisational measures and failed to report within 72 hours.
Commentary: Even small-to-mid sized firms face fines for poor cyber hygiene. Ransomware isn’t just a data virus; it’s a compliance failure too. Firms should adopt proactive backups, incident detection, and reporting protocols.
Insights for UK Businesses
- Phishing remains the top threat vector, especially in white-collar industries.
- Small breaches aggregate to millions affected when summed across a sector.
- Regulatory scrutiny affects even smaller firms; compliance must be consistent and fast.
Legislative Context
These cases occurred before the Data (Use and Access) Act 2025, but they highlight the need for stronger detection and mandatory reporting; themes central to the new legislation.
Conclusion
February reminds us: data protection isn’t optional for mid-sized professional firms. If you’re processing client data, treat every email as a firewall test; and every delay in reporting as a spotlight on regulatory risk.
