Researchers warn of surging law firm cyber attacks fueled by AI

By Mike Scarcella

Oct 28 (Reuters) - Cyberattacks on law firms and other legal industry entities have doubled since 2023, according to new research from cybersecurity firm CrowdStrike released on Wednesday, amid growing concerns that threat actors are using agentic AI technology to conduct increasingly sophisticated and efficient attacks.

CrowdStrike’s 2026 Legal Threat Landscape Report, covering a one-year period up to August 2026, said cyber adversaries named 455 legal entities on websites used to post hacked materials, up 39% from the prior year.

Law firms hold corporate client communications, merger and acquisition details, intellectual property, government matters and financial records, making them attractive to adversaries seeking financial gain and strategic intelligence.

“What we’re seeing across the broader threat landscape, more and more threat actors are using agentic technology to democratize hacking,” said Adam Meyers, CrowdStrike’s senior vice president for counter adversary operations. “It’s going to get a lot worse before it gets better.”

Reuters has reported that a growing number of law firms were hit with cyber breaches in recent months, including Quinn Emanuel, WilmerHale and Seyfarth. The Crowdstrike report does not name any specific law firm, legal department or legal industry vendor that was exploited.

Austin, Texas-based CrowdStrike is a cybersecurity software firm that helps businesses protect their computers, cloud systems, accounts and data from cyberattacks.

CrowdStrike’s report said threats are coming from entities including profit-motivated “e-crime” groups and nation-state adversaries. The report said China-linked groups likely will remain the greatest intelligence collection threat to the legal sector.

The new report said it found for the first time an entity targeting legal industry-specific software. The hackers in that instance, the report said, exploited a vulnerability in software that law firms use for timekeeping and billing.

In another episode in November, cyber criminals hired a Russian national to walk into a US law firm while posing as an internal IT employee.

Many major law firms targeted in recent cyber attacks said they were victims of a "social engineering" event. Such attacks can involve manipulating people into revealing sensitive information or granting access to secure systems.

CrowdStrike recommended law firms and other industry targets strengthen multifactor authentication and increase their control over remote access tools.

The report also urged stronger data access governance, monitoring for unusual data access and preparation for data theft, extortion and disruptive operations.

Read more:

Pentagon hit with class action over data breach affecting millions of military members

Law firm Sheppard Mullin sued in class action after data breach disclosure

Law ⁠firm Seyfarth ​says breach exposed client documents

Law firm Greenberg Traurig faces ​class actions after cyber breach

Data at law firms Quinn Emanuel, McDermott exposed in cyber breaches

Law firms Herbert Smith, Goodwin ​hit by data breaches

Law firm WilmerHale sued in class action after data breach