Insider Threats Responsible for 68% of UK Legal Data Breaches

It’s still difficult to dismiss the effect that working from home and working remotely has had on insider data theft.

More than two years have passed since the World Health Organization initially declared COVID-19 a pandemic and with it, a shift to working from anywhere. That’s posed a challenge to administrators, many who had to turn on a dime, and learn how to protect corporate data beyond the office doors.

New numbers released this week highlight how serious the threat of insider-driven data loss has become for law firms, particularly those based in the United Kingdom.

At one point last year, more than two thirds (68%) of data breaches at firms were caused by insiders. NetDocuments, a document and email management service, looked at numbers from the Information Commissioner's Office (ICO) - the U.K.'s data protection watchdog - and found that the bulk of breaches in Q3 2021 stemmed from actions taken by insiders.

The rest of the breaches (32%) were caused by outside threats, like hacks.

It's important to note that as is usually the case with insider threats, the breaches don’t necessarily correspond to malicious actions taken by employees. Many of the breaches can be linked back to human error, like an employee botching an email send by failing to use blind carbon copy (bcc) or emailing documents of sensitive personally identifiable information (PII) to the wrong recipient.

The full scope of the data loss breaks down as follows:

• 52 percent of data breaches in the legal sector occurred from sharing data with the wrong person (i.e., via email, post or verbally)
• 25 percent of data breaches in the legal sector occurred from phishing attacks
• 10 percent of data breaches occurred from losing data (i.e., loss/theft of device containing personal data, or of paperwork or data left in insecure location)
• 54 percent occurred from human error (i.e., verbal disclosure; failure to redact or use bcc; alteration of data; hardware mis-configuration; documents emailed or posted to wrong recipient)

Having a solution in place to mitigate data loss and protect against the unauthorized removal of sensitive information, even if it's accidental - like data sent through email - can go a long way in preventing breaches like the aforementioned ones from occurring.