Cyber Security & Managed IT for Perth Legal Firms

What We See in Perth Legal Firms Environments

FAQ

Why Perth law firms are a soft target for invoice fraud

A Perth conveyancing or family law practice moves real money on someone else's behalf every week. Settlement funds, trust account transfers, retainers, disbursements. That makes a 5-50 staff firm in West Perth or Joondalup far more attractive to attackers than its size suggests, because one redirected settlement is worth more than a year of ransomware against a bigger but cash-light business.

The most common attack is not dramatic. A criminal quietly reads a partner's mailbox for weeks, learns how the firm phrases its trust account emails, then at the moment of settlement sends the buyer's solicitor new bank details from a near-identical domain. The money lands offshore before anyone notices. In WA, the duty to safeguard trust money sits squarely with the practice, and the Legal Practice Board does not accept "we were hacked" as a defence. The firm wears the loss, the client complaint, and the professional conduct exposure.

What actually goes wrong, and how it unfolds

The entry point is almost always a single set of credentials. A legal secretary reuses her work password on a recipe site that gets breached, or a paralegal clicks a fake "shared document" link and types her login into a convincing Microsoft 365 page. From that one mailbox, the attacker sets a quiet inbox rule that auto-files and deletes any reply mentioning "fraud", "wrong account", or "scam", so the partner never sees the warning bounce back.

For a Perth firm of fifteen people, the damage rarely stops at the stolen funds. Client privilege is compromised the moment an outsider reads the matter file. You face mandatory breach notification under the Privacy Act if personal information was exposed, awkward conversations with your PI insurer, and the practical reality that your team cannot bill while everyone is locked out rebuilding mailboxes and resetting every password. A week of fee earners standing idle costs a firm far more than the IT cleanup.

The other recurring failure is backup. Many firms assume that because matter documents live in a practice management system or in SharePoint, they are safe. They are not safe from a staff member or attacker who deletes them, and the default retention in Microsoft 365 is shorter than most principals expect. When a matter file vanishes and there is no verifiable restore point, the firm is exposed on both the client obligation and the evidentiary record.

How COREWEST closes the gaps, Microsoft-first

We work inside the Microsoft 365 environment your firm already pays for, and turn on the protection that is usually sitting dormant. The build is specific:

• Defender for Office 365 inspects inbound mail for impersonation and lookalike domains, so the "new bank details" email from a spoofed firm gets quarantined before it reaches a fee earner at settlement.
• Entra ID with Conditional Access stops a stolen password from being enough on its own. A login from an unusual location or an unmanaged device is challenged or blocked, which is what shuts down the credential-reuse attack at the door.
• Microsoft Defender and Intune secure the laptops and phones partners use from home and in court, enforcing encryption and letting us wipe a device remotely if it is lost on the train to the CBD.
• Purview lets us find and govern where privileged client data actually lives across mailboxes, Teams chats and SharePoint, and flag where sensitive matter information is leaking into the wrong folders.
• Microsoft 365 Backup gives you a verifiable, point-in-time restore of mailboxes, SharePoint and OneDrive, so a deleted matter file or an encrypted account is recoverable rather than gone.

We also lock down email authentication with SPF, DKIM and DMARC so other firms and clients can trust that mail claiming to be from your domain genuinely is. That single change removes the easiest path an attacker has to impersonate your principal.

The compliance reality, and where to start

WA legal practices carry obligations that generic IT advice ignores. Trust account integrity and external examination, the duty of confidentiality and privilege, Privacy Act breach notification, and increasingly the cyber control questions that professional indemnity insurers now ask before they renew. When an insurer asks whether you enforce multi-factor authentication, control admin access, and hold tested backups, a vague answer raises your premium or voids a future claim. We document those controls in plain English so you can answer honestly and evidence it.

None of this requires ripping anything out. It requires knowing exactly what is currently exposed. The Free Cyber Risk Snapshot is a 30-minute external look at your firm, no obligation: we check whether your staff credentials are already sitting in known breach data, whether your domain can be spoofed, and where your real gaps are. You will get a plain-English report you can act on, whether you work with us or not. Book it at calendly.com/corewest/30min.