What do the legal and financial information services group LexisNexis and the hotel heiress and celebrity Paris Hilton have in common? The answer, according to a story published earlier this month by the Washington Post, is that last year they were both the victims of the same teenage hacker (who cannot be named for legal reasons) who broke into databases and stole confidential information.

In the case of Ms Hilton, the hacker was able to access her mobile telephone's address book, containing the private phone numbers of the various celebs she was in contact with, and then post the details on a public section of the Internet. Apparently, one of the hacker's favourite tools was a so-called 'Trojan horse' virus which, once lodged inside a victim's computer or network, allows the hacker to access information within the system as if they were a legitimate user.


Now it is tempting to think 'this could never happen to us' because we do not mix in Ms Hilton's social circle and it is also probably fair to say that much of the data traditionally stored on law firm IT systems would be incomprehensible to an outsider. However, the growing use of client extranets and internal staff intranets by law firms means this is changing.


True, you may not have any celebrity clients but your existing clients will be none too happy to learn that some stranger has, for instance, logged on to your conveyancing system via the Web and discovered for how much and for what reason they are selling their home - and that is without getting into the more sensitive areas of legal practice including crime, matrimonial, debt recovery and commercial work.


This column has warned before that firms need to address the issues surrounding e-mail management, including filing, archiving and protection from spam and viruses, but in today's environment, where it increasingly seems that the hackers are always at least one step ahead of the security industry, any firm running anything more advanced than the most basic of Web sites must ensure it is surrounded by adequate security.


In the past, some firms have invested substantial amounts on safes and strong-rooms to physically protect client deeds and confidential documents. That same approach now needs adopting for digital information - unlike one City practice whose IT director recently admitted to me that his firm had spent more than £1 million on a strong-room but nothing on network security.


Charles Christian is an independent adviser to the Law Society's Software Solutions guide