An email, purportedly from a former HR executive, was sent to all staff. It revealed confidential salary and performance information for 906 employees. This Slater & Gordon email attack created internal chaos. Employees viewed sensitive payroll details and performance ratings. The firm later denied the authenticity of the email. They stated that the named individual was not the author and reported the matter to police. Regardless of its origin, this Slater & Gordon data breach raised legal concerns, damaged employee trust, and exposed weaknesses in email security policies.

One key vulnerability in this attack was email impersonation. The email appeared to come from an internal leader but was actually sent from an external email address.

Microsoft Defender for Office 365, included in Microsoft 365 Business Premium, detects and blocks email spoofing attempts. It identifies messages that try to impersonate executives. Anti-impersonation policies prevent external domains from using the names of key staff. This reduces the risk of similar attacks.

Another issue was that the email was delivered to all staff. Many organisations have “All Staff” distribution lists that allow external emails. This increases the risk of phishing and impersonation attacks. Microsoft 365 can restrict these lists to internal senders only. This ensures that external actors cannot send mass emails to employees. A simple setting change could have blocked the email before it reached staff inboxes.

This Slater & Gordon salary leak raises a key question. How can firms ensure that sensitive information, such as salary data or staff performance reviews, remains protected?

Microsoft 365 Business Premium includes Sensitivity Labels and Access Controls. These features restrict access to confidential information to authorised users only.

By applying Sensitivity Labels, documents containing salary data, performance ratings, or confidential HR records can be marked as “Confidential – HR Only”. This ensures that only authorised HR personnel can access them.

Restrictions on forwarding and sharing prevent users from copying, emailing, or distributing sensitive data externally. Even if a file is mistakenly emailed outside the firm, encryption ensures only authorised users inside the organisation can open it.

This Slater & Gordon cybersecurity incident highlights why law firms need robust email security and data protection policies. If you’d like to discuss how Defender for Office 365, Data Loss Prevention (DLP) policies, and Sensitivity Labels can help protect your firm, we’d love to chat.