In late November 2023, a cyber-attack targeted CTS, an IT service provider for law firms, leading to a massive disruption in the operations of many legal businesses. CTS provides cloud-based solutions and software infrastructure to a wide array of law firms, including conveyancing practices. The cyber-attack has left many firms unable to process legal transactions, resulting in delays and significant operational challenges. In this article, we will explore the details of the CTS cyber-attack, its consequences, and the broader implications for the legal industry.

What is CTS and Why Was it Targeted?

Who is CTS?

CTS (short for Conveyancing Transaction Services) is a prominent IT service provider that specializes in supporting law firms, particularly those involved in property transactions. CTS hosts the software and infrastructure that many law firms use for conveyancing, a sector focused on the legal aspects of property sales, purchases, and transfers.

CTS is integral to the functioning of law firms, providing case management systems, document management, and secure client communications. Its services streamline the conveyancing process, helping law firms manage property deals efficiently and securely.

Why Did Cybercriminals Target CTS?

The attack on CTS is part of a growing trend where cybercriminals target managed service providers (MSPs) like CTS. MSPs are attractive targets because they often manage the systems of multiple clients simultaneously, which gives attackers the opportunity to impact numerous businesses in a single strike. By infiltrating the systems of an MSP, hackers can access the sensitive data and operations of multiple clients at once, maximizing the damage.

Cyber-attacks against MSPs have grown in sophistication in recent years. This is primarily because many MSPs, including those serving law firms, may not have robust cybersecurity defenses in place. Furthermore, legal firms are highly targeted due to the valuable data they handle, such as financial records, contracts, and personal information.

The LockBit ransomware group is believed to be behind the cyber-attack on CTS. LockBit is one of the most notorious ransomware groups in the world, responsible for many high-profile attacks across various sectors. These groups often demand a ransom in exchange for restoring access to the affected systems. They also typically threaten to release sensitive data if their demands are not met, adding another layer of pressure on the victims.

The Impact of the CTS Cyber Attack

Disruption to Legal Operations

The cyber-attack on CTS resulted in a service outage that lasted for several days. During this time, many law firms, particularly those specializing in conveyancing, were unable to complete property transactions. This affected not only law firms but also their clients, many of whom were in the process of purchasing or selling properties.

The disruption of critical systems left clients in a state of uncertainty, as conveyancing processes stalled. Many clients who had already arranged moving dates found themselves unable to proceed with the completion of property deals. This caused considerable stress for individuals who were relying on the timely processing of their transactions.

For firms like O’Neill Patient Solicitors, one of the UK’s largest conveyancers, the disruption was particularly challenging. The firm was forced to revert to manual processes to ensure that deals could still be processed, though these methods were far less efficient than the digital systems they typically relied upon. The firm expressed deep empathy for the clients affected by the delays and worked tirelessly to resolve the situation​

Widespread Impact on the Legal Sector

Although the attack primarily affected conveyancing practices, the ripple effect extended to other areas of the legal sector. Property law firms, which often rely on CTS’s systems for document management and case tracking, found themselves unable to meet deadlines or manage client communications effectively.

Small to medium-sized law firms were particularly vulnerable in this situation. Larger firms with more extensive IT infrastructure were able to handle the crisis better by relying on internal systems or manual backup procedures. However, many smaller firms were left exposed without adequate contingency plans in place.

The broader implications of this cyber-attack suggest a systemic vulnerability in the legal sector, where many firms depend heavily on third-party providers for critical infrastructure without fully assessing the security risks involved.

The Response to the Cyber Attack

CTS’s Efforts to Restore Services

In response to the cyber-attack, CTS worked closely with cybersecurity experts to identify the extent of the damage and restore service as quickly as possible. The company issued public statements to reassure clients that recovery efforts were underway, though many clients were left waiting for several days before systems were fully restored.

CTS emphasized that it was using third-party security specialists to help resolve the issue, underscoring the complexity and scale of the cyber-attack. Despite these efforts, the service outage had a lasting impact on clients, many of whom found themselves unable to complete transactions as completion dates loomed.

Client Reactions and Public Outcry

Clients affected by the disruption turned to social media to express their frustration, with many naming and shaming their law firms for being unable to provide clarity on the status of their property transactions. Some clients even began to question the security practices of their legal service providers, highlighting the growing concerns over the adequacy of cybersecurity measures within the legal sector.

The client frustration was exacerbated by the lack of communication from CTS in the initial days of the outage. While some law firms were able to maintain communication with their clients and find alternative ways to proceed with transactions, others were left completely in the dark.

Lessons Learned for the Legal Sector

The CTS cyber-attack highlights several key lessons for law firms and other industries reliant on third-party IT services:

Vetting IT Providers: Law firms must carry out rigorous due diligence when selecting IT service providers. This includes evaluating the provider’s security measures, the integrity of their data protection systems, and their disaster recovery protocols.

Contingency Planning: Firms should have clear and comprehensive contingency plans in place for handling IT disruptions. This may include maintaining backup systems, establishing manual procedures, and having cybersecurity experts on standby.

Cybersecurity Awareness: Law firms must increase their awareness of cybersecurity risks. It’s crucial that firms understand the potential vulnerabilities that come with outsourcing IT services, particularly when handling sensitive data.

Collaborating with Experts: As cyber-attacks become more complex, law firms must engage with cybersecurity experts who can provide proactive support to help mitigate potential risks and quickly resolve issues when they arise.

The Growing Threat of Cyber-Attacks

The CTS cyber-attack serves as a stark reminder of the vulnerabilities that exist in the digital infrastructure of law firms and other businesses. While the legal sector is increasingly reliant on technology to streamline operations and serve clients more efficiently, this dependence also exposes firms to significant risks.

As cybercriminals continue to target MSPs, it is imperative that law firms take steps to secure their digital assets. This includes selecting trusted IT service providers, implementing comprehensive cybersecurity policies, and preparing for the possibility of a breach with robust contingency plans.

In the aftermath of the CTS cyber-attack, it is likely that many law firms will reassess their approach to cybersecurity and begin investing more in internal IT resources or more secure third-party providers. In doing so, they can help ensure the continuity of operations and safeguard client trust in the increasingly digital landscape of the legal profession.

FAQs

What is CTS and Why Was It Targeted?

CTS (Conveyancing Transaction Services) is a managed IT services provider that supports law firms in the UK and Ireland. Their services include cloud hosting, data storage, document management, and case management systems, specifically for firms involved in property law and conveyancing. CTS was targeted because, as a managed service provider (MSP), its systems served multiple law firms, making it an attractive target for cybercriminals. The attackers aimed to exploit the vulnerabilities of CTS’s infrastructure to gain access to the sensitive data and operations of its clients.

The LockBit ransomware group, known for targeting MSPs, is believed to have carried out the attack, which caused widespread disruption across law firms that depended on CTS’s systems for everyday operations.

What Were the Immediate Effects of the Cyber Attack?

The immediate effects were severe for law firms relying on CTS for conveyancing services. The attack led to a service outage that lasted several days, during which many firms were unable to complete property transactions. This caused considerable stress for clients, particularly those in the middle of property deals who had already set moving dates. Law firms had to revert to manual processes in some cases, which was inefficient and slow.

The disruption was also felt by clients who found themselves unable to proceed with the completion of property sales or purchases. The delay in transactions led to frustration, and some clients even questioned the security measures taken by their law firms.

What Type of Cyber Attack Was It?

The attack on CTS was a ransomware attack, in which hackers encrypted the data and demanded a ransom in exchange for the decryption key. The cybercriminal group behind the attack, LockBit, has been notorious for this type of attack, which has increasingly targeted MSPs in recent years. By compromising the provider’s systems, attackers can impact multiple clients at once, making the attack more profitable for them.

Ransomware attacks typically involve not only encrypting files but also threatening to release sensitive data if the ransom is not paid. This creates an additional layer of pressure on businesses, as they must protect both their operational data and client information from being leaked.

How Long Did the Recovery Process Take?

CTS worked around the clock to restore services, but the recovery process was not immediate. Clients were left waiting for several days before systems were fully operational again. The company worked with cybersecurity specialists to determine the extent of the attack and to ensure that its systems were secure before bringing them back online. During this time, many law firms found themselves unable to access their case management systems or complete the conveyancing transactions that were dependent on CTS’s services.

Although CTS eventually restored its systems, the prolonged outage affected hundreds of clients, particularly in the conveyancing sector. Law firms were advised to communicate regularly with their clients to keep them informed about the status of the recovery, though this did not always assuage concerns.

What Did Clients and Law Firms Do During the Outage?

During the outage, many law firms took manual steps to try and keep transactions moving forward. Some firms resorted to paper-based systems, while others relied on internal backup systems, if available. Larger firms with more robust IT infrastructure were better positioned to handle the disruption, but smaller firms were more vulnerable and faced greater challenges.

Law firms also communicated with clients, though many clients were understandably frustrated by the lack of clear updates on when services would be restored. Some clients had to delay their property transactions entirely, while others attempted to find alternative solutions, including working with different firms or service providers.

In Summary

The CTS cyber attack has had a profound impact on law firms, particularly in the conveyancing sector. It has exposed vulnerabilities in the way law firms manage their IT services and data. As ransomware attacks become more sophisticated, the legal industry must adapt and implement stronger cybersecurity practices. Law firms must be vigilant about protecting client data and ensure they are prepared for cyber threats. This attack also highlights the need for more comprehensive cybersecurity training, contingency planning, and a renewed focus on safeguarding client information.

To read more, Click here.