Background
Our client is a senior commercial barrister who handles high-value, high-sensitivity international litigation. The kind of work where confidentiality isn’t just good practice, it’s the entire foundation of client trust.
During the pandemic, he called us on a Saturday morning, visibly shaken. He’d been in court the day before and realised, mid-hearing, that the opposing side already knew almost everything he was about to present — arguments and evidence he’d prepared privately, on his own laptop, the day before.
The Risk
For a barrister, the risk here isn’t just financial — it’s existential. Legal professionals are high-value targets precisely because of what they know: privileged case strategy, client instructions, and commercially sensitive material, often worth far more to an attacker than any fee involved. A breach of client confidentiality or legal privilege carries professional, regulatory and reputational consequences that go well beyond the immediate data loss.
We started where data breaches most often start: the cloud account and the endpoint. His email and file storage were already protected under our Email Security service, with two-factor authentication enforced on every account — so we could rule that route out with confidence. His laptop, however, was running only a standard consumer antivirus. Adequate for everyday threats, but never built to detect targeted tooling aimed at a specific, high-value individual.
What We Did
We deployed our enterprise endpoint protection (SentinelOne) to get proper visibility into what was actually running on the machine. Within hours, it found two things:
- A keylogger hidden in Chrome, silently recording everything he typed — case notes, client communications, legal strategy.
- A disguised update prompt — a fake Windows-update pop-up sitting in his Downloads folder, which had opened an outbound data leak.
The key lesson here is one we come back to again and again: he is not, by his own admission, especially technical. He did exactly what most careful, conscientious professionals do — trusted a familiar-looking prompt and clicked “OK.” The point of failure was never attacker sophistication. It was one habit, repeated for years, which is exactly why awareness alone isn’t enough without proper endpoint monitoring behind it.
We used SentinelOne to remove the browser hijacker and eliminate the disguised update file causing the data leak, then rebuilt his endpoint protection to enterprise standard so the same technique couldn’t simply be repeated. No forensic evidence pointed to a specific actor — but the pattern (data leaving quietly, in the background, timed around his most sensitive work) was consistent with deliberate, targeted surveillance rather than opportunistic malware.
The Result
That was around four to five years ago. Since securing his laptop, he has never again had the experience of an opponent appearing to know his case in advance — and he continues to win his cases. What could have been a career-threatening breach of privilege and confidentiality was caught, diagnosed and closed before it caused lasting damage.
Why This Matters for Law Firms
- Legal professionals are high-value targets precisely because of what they know — privileged case strategy, client instructions, and commercially sensitive material, often worth far more to an attacker than the fee involved.
- Consumer-grade antivirus is built to catch common malware, not targeted tooling like keyloggers and disguised update prompts aimed at a specific individual.
- The point of failure is rarely technical sophistication on the attacker’s side — it’s a familiar-looking prompt and a trusted daily habit.
- A breach of client confidentiality or legal privilege carries professional, regulatory and reputational consequences well beyond the immediate data loss.
Worried This Could Be Happening in Your Firm Right Now?
We offer law firms a free, no-obligation cyber exposure check — covering email security (DMARC), exposed subdomains, and dark web credential exposure — so you know exactly where you stand before it becomes a case like this one.
Get in touch to arrange yours: support@security-everywhere.com · +44 20 3195 0555 · www.security-everywhere.com
Note: details in this case study have been anonymised to protect client confidentiality. This account is drawn from a recorded first-hand telling of the incident by Francis West.
Worried this could be you? Take our free Cyber Security Health Quiz — 3 minutes, 25 questions, no obligation.
More for legal practices: see our cyber security for conveyancing firms page for how the same weaknesses play out where client money is involved.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
