A study of 40 law firms which suffered a cyber-attack over the past three years has found that more than £4m of client money was stolen from 23 of them.