Law firms worldwide are facing a growing cybersecurity challenge as attacks become more frequent and criminals explore artificial intelligence (AI) to make their operations more sophisticated. A new report from cybersecurity company CrowdStrike highlights the exposure of legal organisations that hold confidential corporate records, financial information and sensitive government-related documents.
The findings underline the importance of stronger digital security, employee awareness and careful management of access to confidential information.
Cyberattacks Against Legal Organisations Are Increasing
According to CrowdStrike’s 2026 Legal Threat Landscape Report, cyberattacks targeting law firms and other legal organisations have doubled since 2023.
The report examined threats affecting the legal sector over the 12-month period ending in August 2026. During that period, 455 legal organisations were named on websites used by cybercriminals to publish stolen information—a 39% increase compared with the previous year.
Such disclosures can expose organisations to reputational damage, operational disruption and potential legal or financial consequences. They also highlight how confidential information has become a valuable target for criminal groups.
Why Law Firms Are Attractive Targets
Legal organisations routinely handle sensitive material that may be valuable to both financially motivated criminals and groups seeking intelligence. Their records can include merger and acquisition documents, intellectual property, internal corporate communications, financial details and government-related information.
A successful breach may therefore expose not only a law firm but also its clients and business partners.
The supplied report mentions recent cybersecurity incidents involving major firms such as Quinn Emanuel, WilmerHale and Seyfarth. However, it does not establish that these organisations were among the specific victims counted in CrowdStrike’s findings. The distinction matters because general reports of security incidents should not be treated as confirmation of inclusion in a particular dataset.
How Artificial Intelligence Is Changing the Threat
CrowdStrike has raised concerns about the growing use of agentic AI in cyber operations. These systems can carry out multi-step tasks with varying degrees of autonomy, potentially helping attackers coordinate activities more efficiently.
According to the report, Adam Meyers, CrowdStrike’s senior vice-president for counter-adversary operations, warned that the technology could make cybercrime easier to conduct.
AI may lower some technical barriers and help criminals scale certain activities. However, AI is not the only factor behind successful attacks: weak access controls, vulnerable software, stolen credentials and human error can also create opportunities for intrusions.
For law firms, the challenge is to strengthen security controls while assessing how emerging technologies may affect their risk exposure.
Financially Motivated and State-Linked Groups Pose Risks
The report identifies both financially motivated cybercriminal groups and state-linked adversaries as threats to legal organisations. CrowdStrike assessed that China-linked groups would likely remain a significant intelligence-gathering threat to the sector.
Researchers also described an incident involving software developed specifically for legal operations. In that case, attackers reportedly exploited a vulnerability in software used by law firms for timekeeping and billing.
The incident illustrates why security reviews should cover not only a firm's own systems but also the specialist applications and external vendors on which its operations depend.
Social Engineering Remains a Major Weakness
Technology alone does not explain the threat. Social engineering—manipulating people into revealing information or granting access—continues to be used against legal organisations.
The supplied report also describes an alleged incident in which a Russian national was recruited to enter a US law firm while posing as an internal IT employee. The example illustrates how attackers may combine digital techniques with attempts to exploit trust in workplace procedures.
Law firms can reduce these risks by verifying unusual requests independently, applying multi-factor authentication, restricting access to sensitive records and training staff to recognise suspicious communications. Vendor access should also be reviewed regularly, with clear procedures for reporting potential security incidents.
What Law Firms Should Take Away
The findings point to a broadening risk environment in which legal organisations must prepare for both conventional cyber threats and attacks that may be accelerated by AI. Strong access controls, employee training, secure software and third-party risk management are essential parts of a practical response.
For organisations assessing the financial implications of suspected fraud or irregular transactions following a security incident, financial investigation services may be relevant to reviewing the financial trail and supporting further assessment.
As AI capabilities develop, law firms will need to keep their security practices under regular review. Protecting confidential client information requires a combination of technical safeguards, well-defined internal procedures and informed staff.