An accounting firm, a consultancy or a corporate law firm has one thing in particular in common: for each of its clients, it holds what those clients would entrust to no one else, from annual accounts, payslips and tax returns to directors’ identity documents, bank details and plans to sell the business. For an attacker, compromising a single firm means opening dozens, sometimes hundreds, of client files in one go. That is what makes these professions a prime target, and what makes the cybersecurity of the tool an accounting firm uses to exchange with its clients far more strategic than it might seem.
The firm, a concentration point for its clients’ data
The summer’s news was a stark reminder: at the end of August 2026, the Everest ransomware group claimed an attack on a French accounting, audit and consulting firm, saying it held more than a terabyte of data and several million files, including tax return packages, contracts and clients’ identity documents. Whatever the outcome of the case, it illustrates a well-known pattern: firms are attacked not for themselves, but for what they hold on others.
The trend is clear enough that France’s national institute of chartered accountants (Conseil national de l’ordre des experts-comptables) joined the Cybermalveillance.gouv.fr scheme in 2024, giving the profession direct access to diagnostics and approved service providers. The CESIN barometer published in early 2026 confirms the underlying trend: 40% of French companies suffered a significant cyberattack in 2025, and in eight cases out of ten their business was directly affected. A third of the organisations surveyed also attribute more than half of their incidents to a supplier or service provider. For a firm, this means two things: it can be the victim, but it can also be the service provider through which the attack reaches its own clients.
Email, the attackers’ favourite way in
The most common scenario calls for no technical prowess whatsoever. It begins with a phishing email, sometimes written with the help of artificial intelligence, without a single mistake, in the exact style of a colleague or a client, as we described in “Social Engineering 2.0: when AI gets involved”. Once an employee’s mailbox has been compromised, the attacker watches, then acts: they send clients an invoice or a payment request that mirrors the firm’s layout, with altered bank details. A client in a hurry at the end of the month pays without checking. For 2024, Cybermalveillance.gouv.fr reported a rise of almost 30% in reported fake transfer orders, and requests for assistance on the subject nearly doubled.
The other structural weakness lies in the way documents circulate. Balance sheets, payslips and identity documents still very largely travel as email attachments or through sharing links from consumer services, with no traceability and no expiry date. An employee who leaves the firm, an intern whose account was never deactivated, an access portal to the practice software protected by a reused password: each of these details is a door that nobody is watching.
What the law and insurers now expect of you
Beyond the operational risk, the regulatory framework has tightened. In the event of a personal data breach, the firm must notify the CNIL, the French data protection authority, within 72 hours of discovering the incident, and inform the people concerned if the risk is high. The CNIL recorded more than 6,100 data breaches in 2025, up around 10% year on year, and imposed fines totalling close to half a billion euros. Since France’s LOPMI law, filing a police complaint within 72 hours has also been a condition for compensation under a cyber insurance policy.
Insurers, for their part, are no longer satisfied with a sworn statement. Before covering a firm, they require multi-factor authentication, offline backups, an endpoint detection tool and staff awareness training. A firm that cannot demonstrate these measures pays more, or is not insured at all. For firms whose clients are subject to NIS2, the question also arises the other way round: those clients are starting to audit the security of their service providers, their accountant included.
Securing exchanges with clients and between colleagues
The basic measures are well known and can be summed up in a few lines: multi-factor authentication on email and the practice software portal, a password manager for the whole team, access rights matched to each employee’s actual needs rather than administrator access by default, backups following the 3-2-1 rule, updates applied without delay, and a written procedure setting out who to alert, and in what order, in the event of an incident. Add to this a common-sense rule to put up in the office: any change of bank details is confirmed by calling the number already on file, never the one given in the message.
That leaves the most fundamental question: where the exchanges actually take place. As long as sensitive documents circulate by email and through sharing links, the measures above patch things up without addressing the root cause. This is why regulated professions are turning to dedicated exchange spaces, where each client file is partitioned, access is named and revocable, and hosting meets verifiable requirements. We set out the framework for this approach in “Cybersecurity 2025: securing without complicating” (in French).
What Whaller brings to a firm
Whaller lets you create a private sphere for each client, in which the firm and its contact exchange documents, questions and approvals without a single document passing through email. The client sees only their own space, the employee in charge sees their files, the partner sees everything, and each access can be withdrawn in one click when an engagement ends or an employee leaves the firm. Documents are stored in the built-in document management system, versioned and accessible from the mobile app, putting an end to balance sheets sent as attachments and forgotten sharing links.
The firm also has Whaller Mail, an integrated sovereign email service whose accounts are created and deleted from the administration console, and Whaller Signature to have engagement letters, mandates and certificates signed directly in the client space. The most sensitive exchanges, such as a planned business sale, can take place in an end-to-end encrypted sphere that even Whaller cannot read. Everything is hosted in France, with OVHcloud, and Whaller holds the Numérique France Garanti certification.
For firms handling data covered by trade secrets or working with operators of sensitive activities, Whaller DONJON offers the same platform on a physically dedicated instance, qualified SecNumCloud 3.2 by ANSSI, France’s national cybersecurity agency, document management included. We explained in “Digital vault: why integrating EDM into a SecNumCloud qualified solution makes all the difference” why this complete scope matters: a vault whose document management was hosted elsewhere would protect very little. Finally, Whaller RESILIENCE provides an independent fallback space to keep reaching employees and clients if the main information system becomes unavailable, which is precisely when a firm most needs to communicate.
In practice
A firm with ten employees and two hundred client files can structure its Whaller space as a “Firm” organisation for internal life, one sphere per client for external exchanges and an encrypted sphere for confidential operations. Setting it up requires no development, and a demo is usually all it takes to map out the firm’s existing organisation.
Your clients’ trust starts with how you look after their data
An accountant, a consultant or a lawyer sells trust above all else. Cyber Security Month is a good opportunity to check that the firm’s tools live up to that promise: review access rights, deactivate dormant accounts, switch on two-factor authentication everywhere, and ask yourself honestly how many client identity documents are sitting in inboxes right now. ANSSI’s MesServicesCyber service offers a free maturity test to get started, and the Whaller team is here for what comes next.
0 Comments