This case involves a law firm based in the south of England.  The firm was of a reasonable size and, like most law firms, held a lot of very sensitive customer data.

One morning one of the solicitors received a Facebook message purporting to be from a young law student.  The message read:

“Dear Jennifer,

I am a huge fan of the work your law firm do.  I am in my penultimate year of law school and I was hoping I might be able to do some summer holiday work experience at your firm.  I see you also attended the same law school!  I have attached my C.V for your consideration”

 Jennifer, opened the C.V.   It looked like a blank word document.  She replied requesting her to resend the C.V.  Quickly forgetting about the entire experience Jennifer went about her day as usual.

Unbeknownst to Jennifer, the attachment had dropped malware known as a trojan onto the system.  It gave the attackers a view of the firm’s online banking account.  They could see what money had gone in from clients and all the payments and direct debits going out of the account.

Fast forward a few days.  Two clients had paid in money for the purchase of a house.  The attackers, still watching the law firm’s bank account, saw this happen.

That morning the receptionist received a call from the “bank”.

“Hello, we are from your bank.  There is a problem with your account and it needs to be validated.  If this isn’t done today then no payments can leave the account”