Law firm cyberattacks are rising as hackers target client data and exploit weak security. According to a new report from cybersecurity firm CrowdStrike, law firms face growing risks. Criminals often seek money, while other groups may want secret business or government data.
CrowdStrike’s
2026 Legal Threat Landscape Report, released on October 28, found that cyber intrusions targeting law firms nearly doubled between 2023 and 2026. In addition, the report highlights a rise in data theft across the legal sector.
Hackers named 455 legal groups on websites that publish stolen data between September 2025 and August 2026. This figure marks a 39% rise from the previous period.
Artificial intelligence (AI) may help hackers launch attacks faster. However, firms still face familiar threats, such as stolen passwords, fake emails, and weak software. Therefore, law firms must protect their systems, staff, and client records.
Key Takeaways
- Attacks are rising: CrowdStrike found that cyber intrusions against legal groups nearly doubled between 2023 and 2026.
- Data theft is growing: Hackers named 455 legal groups on data leak sites, up 39% from the previous period.
- Money is a key motive: Financially driven attackers made up 82% of the harmful activity CrowdStrike tracked in the legal sector.
- AI may speed up attacks: New AI tools could help hackers work faster and carry out complex tasks.
- Office security matters: For example, one attack involved a person who posed as an IT worker to enter a law firm.
- Legal software faces risks: Researchers found an attack that exploited a flaw in timekeeping and billing software.
- Firms can take action: Therefore, better login security, staff training, and software updates can help reduce risk.
Law Firm Cyberattacks Target Client Data
Law firms hold data that hackers may want to steal. For example, this can include client emails, merger plans, financial records, and trade secrets.
Some firms also handle sensitive government cases. As a result, a data breach can harm both a law firm and its clients.
Hackers may steal files to demand money. Alternatively, they may sell the data or threaten to release it. In either case, firms can face serious risks.
CrowdStrike found that financial gain drove 82% of the harmful activity it tracked against the legal sector. Meanwhile, other groups may seek data for spying or other goals.
Stolen Data Creates Extortion Risks
Hackers often use stolen data to pressure their victims. For instance, they may threaten to publish private files unless the victim pays.
CrowdStrike found that 455 legal groups appeared on data leak sites between September 2025 and August 2026. This marked a 39% rise from the previous period.
The harm can also spread beyond the law firm. For example, stolen merger plans could affect clients, investors, and business partners.
Therefore, law firms must treat data security as a core business need. It should not be seen as a task for the IT team alone.
How AI Fuels Law Firm Cyberattacks
AI gives hackers new ways to automate tasks. In addition, it may help them plan attacks and find weak points faster.
CrowdStrike warns that advanced AI tools could help criminals move from breaking into a system to stealing data in less time. As a result, security teams may have less time to spot and stop an attack.
However, AI is not the only cause of rising cyber threats. Hackers still rely on stolen passwords, weak security, and human error.
Agentic AI Raises New Security Concerns
Agentic AI can carry out several tasks with little human input. For example, it may plan steps and adjust its actions as work moves forward.
Hackers may use these tools to speed up parts of an attack. Additionally, CrowdStrike executive Adam Meyers warned that AI could make advanced hacking methods easier to use.
Law firms should also review the AI tools they use. Some tools may handle client files, legal research, or private business records.
Therefore, firms need to know what data these tools can access. They should also check how vendors store and protect that data.
The report does not show that AI alone caused the rise in attacks. Instead, it warns that AI could make future threats faster and harder to manage.
Hackers Use Digital and Physical Attacks
Some criminals use more than online tools to break into systems. They may also try to gain access to offices and devices.
CrowdStrike reported a 129% rise in activity by a group known as CHATTY SPIDER during the first eight months of 2026, compared with all of 2024.
In one case, the group used a person who posed as an IT worker. That person entered a U.S. law firm’s office and accessed a workstation.
As a result, the incident shows why firms must protect their offices as well as their computer systems.
Social Engineering Puts Law Firm Security at Risk
Social engineering occurs when hackers trick people into sharing data or granting access.
For example, a criminal may pose as an IT worker and ask for a password. Alternatively, another may send a fake email that looks like a message from a partner.
These tricks rely on trust rather than software flaws. Therefore, staff awareness is an important part of law firm security.
Law firms should train staff to spot unusual requests. They should also ask employees to check the identity of anyone who requests access to systems or data.
In addition, firms should check visitor access and keep sensitive work areas secure.
Legal Software Flaws Put Law Firms at Risk
CrowdStrike also reported an attack on software made for the legal sector.
According to the report, a China-linked group known as TITAN PANDA exploited a flaw in Intapp Time Server. This software helps law firms track time and manage billing.
Researchers described this as the first observed attack of its kind against software built for the legal sector.
This finding raises concerns for firms that rely on special tools to run their businesses. For example, billing systems may connect to staff accounts and financial records.
Therefore, a flaw in one tool could expose other sensitive data.
Steps Law Firms Should Take
Law firm leaders should work with IT staff to find weak points in their software. They should also install security updates as soon as possible.
Furthermore, firms need to check which vendors can access their systems. They should limit that access to what each vendor needs.
In addition, firms should review how third-party tools store client data. These steps can reduce risk, although no single fix can stop every attack.
How Cyberattacks Harm Firms and Clients
A cyberattack can cause serious harm to a law firm. For example, it may lead to lost work, high recovery costs, and damage to the firm’s reputation.
Clients may also face risks when hackers steal private records. As a result, one breach can affect several people or businesses.
Stolen merger files could reveal a planned deal. Similarly, leaked court records could expose case plans or private client messages.
These breaches can weaken trust between lawyers and clients. They may also lead to legal or regulatory problems.
Therefore, law firms should make data security part of their risk plans. Lawyers, firm leaders, IT staff, and outside vendors must work together to protect sensitive records.
How Law Firms Can Prevent Cyberattacks
Law firms cannot remove every cyber risk. However, they can take clear steps to make attacks harder and limit the damage.
1. Use Strong Login Security
Require multifactor authentication for email, remote access, and cloud tools. This adds another check beyond a password.
In addition, firms should remove access when staff leave. They should also review user accounts often to make sure only approved people can log in.
2. Limit Access to Client Data
Give each employee access only to the files needed for their job. This can limit the harm if an account is hacked.
Therefore, firms should review access to client records, financial files, and merger plans. They should also remove access that staff no longer need.
3. Watch for Signs of an Attack
Security teams should look for strange login attempts and unusual file downloads. Likewise, large data transfers may signal a breach.
Firms need a clear process for reporting and checking these warning signs. As a result, quick action may stop an attack before more data is lost.
4. Update Software and Check Vendors
Keep legal software, operating systems, and security tools up to date. These updates often fix flaws that hackers may exploit.
Meanwhile, firms should ask vendors how they protect data and handle security problems. They should also check which systems and files each vendor can access.
5. Train Staff to Spot Scams
Teach staff to spot fake emails, strange phone calls, and false requests for passwords.
More importantly, employees should check unusual requests through a trusted channel. They should never share private details just because a message appears to come from a partner or IT worker.
6. Prepare for a Cyberattack
Create a plan for handling a data breach. It should explain how to stop the attack, save evidence, restore systems, and contact affected clients.
In addition, firms should test the plan with regular drills. They should also check backups to make sure they can restore key files after an attack.
Cyberattacks: Impact on Law Firms
Cyber threats now pose a major challenge for law firms and legal tech providers. As firms use more digital tools, they must also improve how they protect client data.
AI may help hackers work faster. Therefore, law firms should review their security plans often and respond to new risks.
Lawyers and IT teams must also work together. For example, lawyers need to understand how digital tools affect client privacy. At the same time, firm leaders must provide the staff and resources needed to protect key systems.
Law firm cyberattacks threaten client trust, business records, and daily legal work. For this reason, firms should protect their systems, offices, staff, and vendors as part of one clear security plan.
Ultimately, CrowdStrike’s findings serve as a warning for the legal sector. Law firms must prepare for changing threats while keeping client data safe.
Frequently Asked Questions
Why do hackers target law firms?
Law firms hold private client messages, financial records, trade secrets, and legal files. Hackers may steal this data to demand money or sell it. In addition, some groups may seek sensitive business or government information.
How does AI increase cyber risks for law firms?
AI may help hackers automate tasks and plan attacks faster. It could also help them find weak points and steal data in less time. However, stolen passwords, software flaws, and fake messages remain major threats.
What did CrowdStrike’s 2026 report find?
CrowdStrike found that cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026. In addition, hackers named 455 legal groups on data leak sites between September 2025 and August 2026. That figure rose 39% from the previous period.
How can law firms protect client data?
Firms can use multifactor authentication, limit access to files, and update software. They should also train staff to spot scams, check vendors, and prepare a plan for data breaches.
Are small law firms at risk of cyberattacks?
Yes. Small firms may hold valuable client data and use the same types of online tools as larger firms. Therefore, they should protect email, secure client files, update software, and review who can access their systems.
Why is cybersecurity important for lawyers?
Lawyers handle private information that must be protected under relevant laws and professional rules. As a result, strong security can lower the risk of data leaks, protect client trust, and help firms keep working after an attack.
What should a law firm do after a cyberattack?
The firm should act quickly to contain the attack and protect its systems. It should also save evidence and seek help from cybersecurity experts. Finally, the firm must check what data was exposed and whether it needs to notify clients or regulators.
Explore legal career opportunities and find your next job with
LawCrossing.
See Also:
Weil Gotshal to Dissolve After Years of DeclineThe post
Law Firm Cyberattacks Surge as Hackers Exploit AI first appeared on
JDJournal Blog.
