What makes law firms different from any other organisations and attractive to cyber-attackers is the legal rules that require maximum confidentiality between attorney and client.