Law Firm Cyberattacks Double as AI Expands Threats
Cyberattacks targeting law firms and other legal organisations have nearly doubled since 2023, according to a new report from cybersecurity company CrowdStrike, as criminal groups and state-linked actors pursue confidential client information and use increasingly sophisticated methods. The findings highlight the growing threat of law firm cyberattacks, with researchers warning that agentic artificial intelligence could make some operations faster and easier to carry out.
CrowdStrike’s 2026 Legal Threat Landscape Report covers activity from September 2025 through August 2026. During that period, attackers named 455 legal entities on websites used to publish stolen data, a 39% increase from the previous year. These listings are often associated with extortion campaigns in which criminals threaten to release information unless victims pay.
Law Firm Cyberattacks Put Confidential Client Data at Risk
Law firms hold privileged client communications, merger and acquisition details, intellectual property, government-related information and financial records. That makes them valuable targets for criminals seeking money and for state-linked groups pursuing intelligence.
CrowdStrike said financially motivated attackers accounted for 82% of the malicious activity it observed against the legal sector. The report also describes growing activity from China-linked groups, which researchers assess are likely to remain a major intelligence-gathering threat to legal organisations.
The report found that activity by a group CrowdStrike tracks as CHATTY SPIDER increased 129% in the first eight months of 2026 compared with all of 2024. In one incident, the group reportedly recruited a person to pose as an IT employee and gain physical access to a US law firm. In another, an attacker attempted to remove sensitive data just four minutes after gaining initial access.
AI Could Make Attacks Faster and More Accessible
CrowdStrike warned that agentic AI could help threat actors conduct more sophisticated operations with greater efficiency. Adam Meyers, the company’s senior vice president for counter adversary operations, said the technology is helping make hacking accessible to a wider range of attackers. The report does not establish that AI was used in every incident it documents.
Researchers also identified an attack exploiting a vulnerability in software designed for legal-sector timekeeping and billing. CrowdStrike described it as the first observed instance in its research of an adversary targeting software specifically built for the legal industry.
Recent attacks have also involved social engineering, in which criminals manipulate employees into revealing information or granting access. CrowdStrike’s report did not identify the specific law firms or legal vendors affected in the incidents it analysed.
How Law Firms Can Strengthen Defences
CrowdStrike recommended stronger multifactor authentication, tighter controls over remote-access tools and more rigorous governance of access to sensitive data. It also urged organisations to monitor unusual data access and prepare for data theft, extortion and disruptive attacks.
The findings suggest that firms need to treat cybersecurity as a client-confidentiality issue as well as an IT concern. As law firm cyberattacks combine credential theft, social engineering, software vulnerabilities and potentially AI-assisted methods, organisations may have less time to detect intrusions before sensitive information is taken.
