Cyberattacks on Law Firms Double; Client Files Appear Online

Industry monitors recorded almost twice as many incidents affecting law firms in the most recent 12‑month period compared with the prior year. The incidents occurred across multiple jurisdictions and hit firms of varying size.

Attack types reported include ransomware, targeted extortion, phishing campaigns and credential‑stuffing attacks. In many breaches attackers gained access using stolen passwords, compromised remote‑access tools or vulnerabilities in widely used practice‑management and email systems.

Files posted or offered for sale on dark web forums and marketplaces include due‑diligence reports, merger and acquisition documents, litigation strategies, witness statements, corporate shareholder records, tax returns and identity documents for clients and executives. Some listings show sample files to prove access; others advertise searchable archives or bulk data packages for resale to third parties.

Law firms that discovered breaches began notifying affected clients and, where required, regulators and data protection authorities. Notifications cite risks to client confidentiality, possible financial loss for affected companies and exposure of personal data that could enable fraud. Several breaches have prompted regulatory inquiries, professional‑conduct reviews and civil claims in jurisdictions with strict data‑protection rules.

Security professionals point to recurring gaps exploited by attackers: incomplete deployment of multi‑factor authentication, delayed software patching, limited segmentation of client data and insufficient cybersecurity training for staff who handle high‑value documents. Ransomware groups that once targeted broad industry sectors have increasingly focused on legal services because attackers can access sensitive records and then attempt extortion.

Some incidents involved immediate extortion demands; in other cases attackers quietly exfiltrated data and sold it to third parties without seeking ransom payments. Security advisers warn that ransom payments do not guarantee removal from resale markets.

Firms responding to incidents reported a range of defensive measures. Actions include enforcing multi‑factor authentication for remote access, encrypting files at rest and in transit, tightening access controls, improving logging and detection systems, and conducting incident‑response exercises with external forensic teams. Several firms are also reviewing cyber‑insurance policies and engaging outside counsel experienced in breach notification and regulatory compliance.

Following breaches, firms face technical tasks to determine the scope of exfiltrated data, legal obligations to meet disclosure timelines and operational challenges in managing client communications and active matters. Clients and regulators are monitoring how firms implement technical controls and comply with notification and remediation requirements.