professional services is the most targeted sector for business email compromise (BEC)
median loss from a single BEC attack targeting a professional services firm
of law firms experienced a security breach in 2025 (ABA survey)
Why Professional Services Are Prime Targets
Attackers go where the money and secrets are. Law firms hold merger-and-acquisition details, intellectual property, and embarrassing personal information. Accounting firms have tax returns, Social Security numbers, and bank account details. Medical clinics hold protected health information (PHI) that sells for 10-50× more than credit card numbers on the dark web. And most professional services firms have minimal security — because "it has not happened to us yet."
📧 Business Email Compromise (BEC)
Attackers impersonate a partner, client, or vendor and request a wire transfer, W-2 forms, or confidential case files. These emails are highly targeted — they reference real cases, use the partner's actual signature block, and arrive during busy periods when nobody double-checks.
📂 Client File Exfiltration
Once inside your network — often via a compromised email account — attackers quietly download case files, tax returns, or patient records over weeks or months. You may not discover the breach until the data appears for sale online or a client reports identity theft.
🔓 Ransomware Targeting Professional Practices
Attackers encrypt all your files — case management systems, document repositories, email archives — and demand payment. Professional services firms are specifically targeted because they are more likely to pay: the cost of lost billable hours and ethical obligations to clients create enormous pressure.
📱 Lost or Stolen Devices
Laptops, phones, and USB drives containing client data get left in taxis, stolen from cars, or lost at airports. If those devices are not encrypted, every client file on them is exposed — and in many jurisdictions, you must notify every affected client individually.
🏥 HIPAA & Regulatory Compliance Failures
For medical practices and their business associates, HIPAA violations carry fines of $100-$50,000 per record. For law firms, a data breach can trigger bar association ethics investigations and malpractice claims. For CPAs, the IRS requires written security plans under the FTC Safeguards Rule.
Security Assessment for Professional Services
Our 20-question assessment covers email security, client data handling, device encryption, access controls, and regulatory compliance readiness.
Start Free Assessment →Professional Services Security Checklist
- 1 Encrypt everything — devices, email, and files.
Full-disk encryption (BitLocker on Windows, FileVault on Mac) is mandatory for every device that touches client data. Use encrypted email for sending sensitive documents (many secure portals exist — Citrix ShareFile, iManage, Clio). Encrypt cloud storage folders containing client files.
- 2 Deploy multi-factor authentication (MFA) everywhere.
Email, case management, cloud storage, accounting software, remote access — every system must require a second factor. Email is the #1 entry point for attackers targeting professional services. MFA blocks 99% of credential-based attacks.
- 3 Create and enforce a written security policy.
The FTC Safeguards Rule, HIPAA, and many state bar association ethics opinions require a written information security plan. It does not need to be 50 pages — a 5-page document covering access controls, encryption, breach response, and training is sufficient for most small firms.
- 4 Verify wire transfers and sensitive requests by phone.
Create a firm policy: any wire transfer, W-2 request, or confidential file sharing request received by email MUST be verified by a phone call to a known number — not a number in the email. This one rule stops 90%+ of BEC attacks.
- 5 Control and audit third-party access.
IT consultants, bookkeepers, e-discovery vendors, and cloud providers all access your systems. Maintain a list. Review it quarterly. Revoke access immediately when a vendor relationship ends. Require vendors to carry cyber insurance that covers your data.
- 6 Get cyber insurance — with appropriate coverage.
General liability insurance typically excludes cyber incidents. A standalone cyber policy covers breach notification costs, legal defense, forensics investigation, and ransomware negotiation. For professional services firms, this is as essential as malpractice/E&O coverage.
- 7 Train every employee on phishing and BEC.
Your smartest partner can fall for a well-crafted phishing email. Run quarterly training sessions. Send simulated phishing emails to test awareness. Make it safe to report mistakes — the faster someone tells IT they clicked a bad link, the less damage it causes.
FTC Safeguards Rule: Is Your Firm Compliant?
If you offer financing, process tax returns, or handle financial data for clients, the FTC Safeguards Rule likely applies. Learn the 9 requirements and how to meet them.
Read FTC Safeguards Guide →