INDUSTRY FACT FILE · PROFESSIONAL & BUSINESS SERVICES

Threat Landscape: Top Cyber Threats Facing Professional and Business Services

The 18 most relevant cyber threats, attacks and industry challenges for law, accounting, consulting, recruitment, staffing, payroll and shared-services firms, and the impact each one has on clients, people and trust.

Professional and business services attract attackers because they concentrate value. One law firm holds the deal documents of dozens of companies; one audit firm holds the unpublished numbers of its clients; one payroll provider holds the salary and bank details of employees at hundreds of employers; one shared-services centre holds privileged access to a bank's payment systems. Fraudsters target the payment instructions that pass through every mandate; ransomware and extortion groups know that firms cannot let client files appear on a leak site; state-linked actors and competitors want deal and litigation intelligence; insiders and departing staff take files with them; and scammers borrow the brands of well-known recruiters and firms to defraud job seekers and clients.

Recent events show the pattern. Mossack Fonseca's leak of about 11.5 million documents in 2016 ended the firm; NotPetya disrupted DLA Piper's email and systems for days in 2017; Deloitte's email system was accessed through an administrator account in 2017; the Clop group exploited MOVEit in 2023, exposing staff data held by payroll provider Zellis for several employers; LockBit hit Infosys McCamish Systems in November 2023, affecting about six million people, and claimed an attack on Allen & Overy the same month; and the UK Information Commissioner fined Capita £14 million in October 2025, noting that an infected device had not been quarantined for 58 hours. In India, security researchers have repeatedly reported exposed or leaked job-seeker databases, including about 29 million records reported by Cyble in 2020 from a CV aggregation service.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by professional services segment (Codec Networks assessment).

4.1 Business email compromise and payment diversion

Every transaction, settlement, fee invoice and payroll run includes a payment instruction, and most still travel by email. Attackers take over a partner's or finance user's mailbox through MFA fatigue, token theft or phishing, watch the thread, set hidden forwarding rules and then send new bank details at the moment of payment, often from a lookalike domain. Losses reported to the FBI from BEC reached about US$3.05 billion in 2025, and recovery depends on how fast the bank is told.

• Questions to test: Are partner and finance mailboxes protected by phishing-resistant MFA and conditional access? Would we see a new forwarding rule or an impossible-travel sign-in within minutes? Is every bank-detail change verified by a call to a known number? Do clients know we never change bank details by email?
• Relevant services: Microsoft 365 or Workspace security review, phishing-resistant MFA, mailbox-rule monitoring in a managed SOC, call-back controls, BEC awareness and a fraud investigation retainer.

4.2 Data theft and extortion of client files

Ransomware groups now steal before they encrypt, because a professional firm's greatest fear is its clients' files appearing on a leak site. Entry usually comes through a VPN or remote-access gateway without MFA, an unpatched internet-facing system or a phished account, followed by quiet copying of document and audit repositories over days or weeks. LockBit's claims against Allen & Overy and Infosys McCamish in 2023 show that size and reputation are no protection.

• Questions to test: Is every remote-access path protected by MFA and patched quickly? Are document and audit repositories segmented and access limited to the matter team? Would the SOC see gigabytes leaving the network? Are backups offline and tested, and do we have a rehearsed extortion response that includes clients?
• Relevant services: external and remote-access assessment, segmentation and access reviews, data loss prevention, EDR and managed SOC, backup testing and ransomware response exercises.

4.3 Supply chain compromise through payroll, file-transfer and SaaS vendors

Payroll providers, HR platforms and shared-services firms exchange files with many clients, so one weakness exposes them all. The Clop group's mass exploitation of MOVEit in 2023 reached employers through payroll provider Zellis; the Capita attack of 2023 affected about 6.6 million people and led to a £14 million fine. Under DPDP, the employer remains the data fiduciary and the provider the processor, so both must show safeguards.

• Questions to test: Which vendors hold our or our clients' people data, and how do they exchange files? Are internet-facing transfer tools monitored and patched within days? Are payroll files encrypted and minimised? Do our contracts set processor safeguards, breach notification and audit rights?
• Relevant services: third-party risk assessments, file-transfer and application testing, encryption and minimisation review, DPDP processor contract review, exposure monitoring and managed SOC.

4.4 Exposure of candidate and employee data

Recruitment and staffing firms collect CVs, phone numbers, salary history and identity documents from people who have not yet joined anyone, and keep them for years. Databases are left in open cloud storage, applicant-tracking APIs leak records and scrapers harvest profiles; the stolen data then fuels fake-job scams in the firm's name. Security researchers have reported exposures of Indian job-seeker data running to millions of records.

• Questions to test: Do we know where every candidate record lives and how long we keep it? Are cloud storage and ATS APIs tested? Are ID documents encrypted and deleted when no longer needed? Do we monitor for fake recruiters and lookalike domains using our name?
• Relevant services: cloud posture and ATS application testing, DPDP programme with retention and minimisation, brand monitoring and takedown support, candidate awareness.

4.5 Detection, reporting and the 6-hour clock

CERT-In requires reporting within six hours of noticing an incident, DPDP will require breach intimation, regulated clients expect prompt notification under their contracts, and listed firms disclose quarterly. Many firms monitor only their firewall and antivirus, so mailbox takeovers, cloud sign-ins and bulk downloads go unseen until a client calls about a missing payment or a leak.

• Questions to test: Are mailboxes, identities, cloud tenants, endpoints and vendor sessions monitored 24x7? Do we see forwarding rules, MFA resets and bulk downloads? Is there a playbook covering containment, client and bank communication, CERT-In reporting and DPDP intimation?
• Relevant services: managed SOC, playbooks, incident records, tabletop exercises with partners, finance, HR and client-service leaders.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation.
• DPDP: breaches of staff, candidate or client personal data trigger intimation to affected persons and the Data Protection Board once provisions commence in May 2027; processors must support the fiduciary.
• Professional bodies: unauthorised disclosure of client information can raise misconduct questions under the Chartered Accountants Act and Bar Council rules.
• Regulated clients: banks, insurers and SEBI-regulated entities invoke notification, audit and termination clauses under their outsourcing and vendor frameworks.
• SEBI LODR: listed firms and listed clients disclose cyber incidents in the quarterly corporate governance report.
• Insurers and courts: cyber and professional indemnity claims, client litigation and police complaints require preserved evidence.

• Could a hijacked partner or finance mailbox redirect a client payment without anyone noticing?
• Who can access each client's files, and would we see them being copied out tonight?
• Which vendors hold our clients' and employees' data, and how would we know if one were breached?
• Could we pass our largest regulated client's security audit this quarter?
• Are backups of documents, audit files and payroll immutable, tested and separate?
• Could we detect, contain and report an incident within six hours while keeping clients informed?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events, company statements and official sources.