Law Firms Face Escalating Cybercrime Threats

Cyber intrusions targeting legal organisations have nearly doubled since 2023, according to new research from cybersecurity company CrowdStrike, highlighting the increasing vulnerability of firms entrusted with confidential corporate and client information. The company's 2026 Legal Threat Landscape Report, published on 28 October, identifies a sharp rise in financially motivated attacks and increasingly sophisticated methods of gaining access to sensitive systems.

The research found that financially motivated criminals accounted for 82% of observed malicious activity against the legal sector. Extortion groups identified 455 legal organisations on data leak websites during the year ending August 2026, representing an annual increase of 39%. Activity attributed to a criminal group known as CHATTY SPIDER rose 129%, with researchers documenting attempts to infiltrate firms through impersonation and manipulation of trusted personnel.

In one incident, attackers recruited an individual to pose as an IT employee and physically enter legal workplaces to establish remote access. Another investigation revealed an attempt to extract sensitive information only four minutes after initial access. CrowdStrike warned that advances in artificial intelligence could further reduce the time available for organisations to detect and interrupt attacks.

Law firms represent particularly valuable targets because their systems contain privileged communications, acquisition plans, intellectual property and sensitive financial records. Compromising one legal adviser may consequently expose information belonging to several corporate clients. The findings underline a growing professional responsibility to secure confidential information against threats that increasingly exploit human trust alongside technical vulnerabilities.