top of page
Search

"Critical vulnerability found on your website." Why law firms are an easy target for beg bounties

Writer: Erwin SOTIRI
Erwin SOTIRI
55 minutes ago
4 min read
Three-panel cartoon: a hooded beg-bounty sender automates his demands with a cheerful robot, then receives a CRITICAL €500 demand from it on his own phone. Caption: Lovely. It has learned the business model.

The email usually arrives at the address on the firm's "Contact" page. The subject line is in capitals: CRITICAL SECURITY VULNERABILITY. The sender calls himself an independent security researcher or an ethical hacker. He has found a serious flaw in your systems. He has not exploited it, of course. He believes in responsible disclosure. He would simply appreciate a reward, often a few hundred euros, before he shares the details.

The industry calls this a beg bounty. The name comes from the security researcher Troy Hunt and plays on "bug bounty", the legitimate programmes in which companies invite researchers to test their systems and pay for verified findings under published rules.

A beg bounty runs the other way round. Nobody invited the sender. In most documented cases, he ran a free automated scanner across thousands of domains, pasted the output into a template and sent it to everyone at once.

What the "vulnerability" usually is

The findings are remarkably consistent. Sophos's Chester Wisniewski examined a batch of these emails and found that most of the "bugs" were not bugs at all. Common examples include:

  • a missing or permissive email-authentication record (SPF, DKIM or DMARC);

  • missing optional HTTP security headers, presented as an open door to clickjacking;

  • a TLS configuration that still accepts an older cipher;

  • a public list of subdomains, labelled CRITICAL.

Some of these are worth fixing. A domain without a proper DMARC policy is easier to impersonate, and that matters for a law firm whose clients act on emails. But fixing them is ten minutes of housekeeping for your IT provider. It is not a discovery worth paying a stranger for.

Why law firms are a natural target

Beg bounties are sent to any organisation with a website, and they are aimed above all at small businesses. Law firms fit the profile unusually well, mainly for one reason: most lawyers cannot tell, on reading the email, whether the claim is serious.

1. The technical gap. Lawyers are trained to assess risk in words, not in DNS records. Faced with "missing DMARC record" or "clickjacking possible", most of us cannot judge in five minutes whether it is trivial or alarming. Many firms are small, outsource their IT and have no one in-house to ask. That uncertainty is exactly what the template is built to exploit. Banks such as CommBank now warn their small-business customers about this.

2. Confidentiality raises the stakes. A message suggesting that client data might be exposed weighs more on a law firm than on a bakery. Professional secrecy, the GDPR and the firm's reputation all depend on that data staying safe. A sender who hints that he might publish "his findings" is betting on that anxiety.

3. Our contact details are public. Lawyers have to be reachable. Firm websites and professional directories list named lawyers and direct email addresses, and that is all a scanner needs.

4. AI has made sending almost free. A plausible-looking vulnerability report now takes seconds to generate. HackerOne says submissions to bug-bounty platforms have grown 2.8 times since January 2025, while valid reports have grown only 1.9 times. Bugcrowd saw submissions more than quadruple over three weeks in March. curl, Nextcloud and Google's open-source reward programme have all paused or restricted payouts because of "AI slop". Professional programmes with triage teams are struggling with the volume. A small firm's general inbox, read by people who are not security specialists, is easier ground.

When it turns into phishing, or worse

Most beg bounties are low-grade opportunism. Some are not. Treat a report as a phishing attempt if it:

  • asks you to open an attachment, run a "proof of concept" or log in to a portal to "see the details";

  • asks for remote access so the sender can "fix it for you";

  • pressures you to pay before you can verify anything, particularly in crypto.

The line that matters legally is the threat. A polite request for a reward after a genuine, detailed disclosure is not a crime. Under the Luxembourg Criminal Code, extortion means obtaining money through violence or threats (Article 470, first paragraph), and blackmail means obtaining it through a threat of revelations or defamatory allegations (second paragraph). Attempted blackmail is punishable too. Whether "pay me or I publish" meets those definitions depends on the facts. If the sender actually got into your systems to find the flaw, unauthorised access under Article 509-1 is a separate question.

There is also a trap on the receiving side. If a report reveals a real breach involving personal data, paying the sender to stay quiet does not make the problem disappear. The breach-notification clock under Article 33 GDPR still runs from the moment you become aware of it.

A five-step response

  1. Don't pay, don't argue, don't click. Do not open attachments or links from the sender.

  2. Have someone technical check the claim. Your IT provider can verify DMARC or headers with free tools in minutes. If the finding is real and trivial, fix it on your own schedule.

  3. Escalate anything specific. A reproducible issue, evidence of access to data or a threat to publish goes straight to counsel and your incident procedure. Document everything.

  4. Publish a disclosure policy. A short security.txt file and a disclosure page say where genuine reports go and state that unsolicited reports are not paid. Genuine researchers will use them, and the policy gives you a standard reply for everyone else.

  5. Close the easy doors. Most of these emails exist because the same three or four settings are missing on thousands of domains. Set a strict DMARC policy, add the standard security headers, and the template has nothing left to say.

The joke in our profession is that lawyers bill for reading. The beg-bounty business model relies on the opposite: that nobody will read the report carefully. Read it once, with someone technical beside you, and most of them answer themselves.

Sources (checked 9 November 2026)

 
 
bottom of page