DPP Law: a little-used administrator account exposed client files

What was reported

The ICO fined DPP Law £60,000 after a June 2022 attack. An infrequently used administrator account lacked multi-factor authentication. Attackers moved across the network and took over 32GB of data; client information was subsequently posted on the dark web. The firm handled sensitive matters, including legally privileged information.

Read the report from Information Commissioner’s Office

Our perspective

Our reading: Access should reflect a current need, not an old configuration. Legal teams considering AI need matter-specific boundaries, with separate decisions about which documents each tool can receive.

Limits of this connection

This concerns law-firm infrastructure and account security. Vivendur is in development and cannot be presented as preventing this breach or guaranteeing legal privilege.