More than 1.2 million email addresses from some of the UK's top 500 law firms are sitting in file dumps on 'the dark web', according to research by UK cybersecurity company RepKnight.

The company has released a white paper which suggests that the email addresses were likely to have been acquired from breaches to third-party websites such as Dropbox and LinkedIn.

That may not even be the full extent of credentials available to potential hackers within the dark web – areas on the internet which require specific software or authorisation to access.

While the white paper noted that there was no indication that law firm systems had been directly hacked as a result of these leaked emails, RepKnight has acknowledged that some law firms are "upset" that the research has raised concerns among clients that their data has been breached.

"A few firms seem to be getting upset that clients have called them up and asked 'has my data been breached'? We think that's a perfectly reasonable question to ask of any of your professional advisers, at any time," said Jeremy Hendy, executive vice president of sales and marketing at RepKnight.

RepKnight additionally found that of the law firm emails it found in its research, nearly 80% of those were found in data dumps where passwords were also acquired, meaning that any overlap between firm account passwords and those found in these third-party websites could expose law firms to risk.

Hendy added: "There are literally millions of credentials floating around out there - some from five years ago, some from last week.

"We've analysed the data relating to the UK's top 500 law firms. We want to make absolutely clear that most of these law firms will have done nothing wrong cybersecurity-wise. Instead, the only reason this data is available is because it has been breached by third-party sites, which those employees have used in good faith. So, far from trying to cause unnecessary alarm, we are trying to raise awareness of an issue that organisations in all sectors have great difficulty dealing with."

According to the white paper, the availability of breached credentials can put firms at risk for a few different types of attack. Hackers can use scripts to attempt to validate the credentials posted online on other popular websites, which they can then use to impersonate users in phishing attacks. The worst-case scenario for most firms, however, is that these published credentials could allow malicious hackers to access employee accounts directly.

Hendy explained that law firms are not especially to blame for their cybersecurity exposure, nor are they the greatest offenders that RepKnight typically sees. "They are no more careless than anyone else. In fact, all these law firms have on average probably far less credentials than other companies we see," he said.

But law firms are not always the most careful either. "There are some people working for very senior law firms, and the password that had been breached is the word 'password,'" Hendy said.

Many of the email credentials that RepKnight's research found dated back a few years - accounts exposed through Adobe's data breach, for example, date back to 2013. But while users may have long changed their passwords since then, Hendy pointed out that encryption methods used to store those passwords are increasingly easy for hackers to bypass or reverse.

Jordan McQuown, chief information officer at cybersecurity consulting group LogicForce, additionally cautioned that even in today's cybersecurity landscape, "not all encryption is created equally. Some websites use easily reversible encryption methods so the passwords can kind of be extracted."

"People don't quite understand that when you use your corporate email domain for your fantasy football league or your dating site, you're bringing exposure to the organisation," Lancaster noted.

That risk, Hendy explained, exists even if you've changed your passwords in the last few years. "People should be aware that there's a risk of attack if you've used a variant of that password in your work account. Someone's got a good starting point," he said.

Hendy noted that many firms find out that their sensitive data sits well outside firm networks only after it has been made public in news reports. "The biggest thing we see right now is that no one is even looking," he said, noting firms often struggle to even know whether user credential data sits outside their networks.

"I certainly think that the amount of money spent on detection is different than the amount of money that's spent on prevention," McQuown said, adding that while firms and companies tend to invest very heavily in their cybersecurity prevention strategies, those strategies clearly aren't foolproof.