Data breach?

GaryBC

Hi guys. 

How seriously do I take this? 

We're selling the parental home. There's three sets of solicitors handling the conveyancing: 

1) ours, 

2. the buyer's old firm (sacked for dragging their heels), and 

3. the buyer's new (current) firm. 

There's also the estate agent handling the sale. 

All ok so far. 

On Friday last I received an email from a different, unknown, solicitor asking me to download a set of documents (it referenced the Memorandum of Sale so it was a bit more targeted than the run of the mill phishing email). This email had the faint whiff of something fishy about it so I put it to one side while I did a bit of poking around. Two things sealed it: one, said firm was struck off by the SRA ten years ago, and; two, a very obscure looking email address. 

So I did no more and passed the email on to all three solicitors and the estate agent (and cc'd the SRA) asking them to check for data breaches. 

I got one reply ("Noted") from the estate agent but not a peep out of any of the solicitors. 

Monday I sent a reminder (promoting the SRA from cc to prime addressee).

Still no response. 

I'm not sure what to do now. It did occur to me to go to the ICO and report the data breach but is this a bit OTT? Or is it that this sort thing is now so commonplace that nobody cares any more? 

born_again

Aside from this is the wrong section.
You need to give them time to look at things.
Email sent on Friday (be lucky if any work on a weekend) then again on Monday. 

If you are that worried, then ring them & refer too the email 👍

GaryBC

Any idea how to move it to the correct section? 

born_again

GaryBC said:

Any idea how to move it to the correct section? 

I would have expected that site staff would have picked this up given the section it is in.
Just you the report button.

user1977

GaryBC said:

I'm not sure what to do now. It did occur to me to go to the ICO and report the data breach but is this a bit OTT? Or is it that this sort thing is now so commonplace that nobody cares any more? 

Whose data breach are you investigating? Why are you copying in the SRA? They're not going to do anything before the law firms have had a chance to investigate (and it might not be a breach on the part of any of them anyway).

It seems a bit unreasonable to inspect instant answers from anyone.

GaryBC

I'm not investigating anything, I'm informing the solicitors that one of them has a leak. 
And I informed the SRA so that they are aware that one of their own isn't taking proper care of client data.
And no, it's absolutely NOT unreasonable to expect, at the very least, an acknowledgement of receipt of the alert by the next working day at the latest. 

But my question is: is this sort of thing now so commonplace that, very much like household burglary, nobody gives much of a damn about it anymore? 

user1977

GaryBC said:

I'm not investigating anything, I'm informing the solicitors that one of them has a leak. 

How do you know any leak is by one of the solicitors rather than another party (such as the EA)?

The SRA won't be interested in an individual matter such as this.

And the other party's solicitors shouldn't be communicating with you at all.

GaryBC

Ok. One at a time.... 
1) I don't, which is why I informed them ALL.
2) I'll leave it to the SRA to decide whether, by allowing data to escape, they consider one of their members in breach of their duty of care and/or GDPR.
3) Yep, dead right. 

silvercar

I'd move the thread if I knew where to put it! 

ciderboy2009

OP - presumably you've confirmed that the breach isn't at your end?

It wouldn't be the first time that a scammer has gained access to someone's email account and used what they see there to run the appropriate scam.

RHemmings

The breach could also be at the seller's end. Without further information, there is a number of places the breach could have occurred. 

Conveyancing fraud is a known risk. https://howells.law/newsroom/conveyancing-fraud-prevention-tips-for-homebuyers/  OP, you did well in checking the bona fides of the 'solicitors' who sent the out of the blue request. Have you reported this to Action Fraud? https://www.actionfraud.police.uk/

It's quite possible that the scammers will try again, by a different method. E.g. it's very important to check bank details, as one common scam is to intercept emails with requests for money (such as a deposit) and change the bank details. (I'm sure the OP is very much on guard).