Big game hunting (BGH) adversaries named 455 legal institutions on their leak sites, a staggering 39 per cent rise from the previous year.
Law firms safeguard some of the most confidential business data. From sensitive client exchanges to business agreements and legal case strategies, the information they possess is invaluable to cybercriminals.
But that trust is relentlessly under attack, according to CrowdStrike’s 2026 Legal Threat Landscape Report. It noted that cyberattacks targeting legal institutions have “nearly doubled between 2023 and 2026.”
Released on Wednesday [October 28], the report examined cyber risk activities against the legal sector in the United States and United Kingdom between the dates of September 1, 2025, and August 31, 2026.
The report found that avaricious cyber criminals are among the top threats to legal institutions. More specifically, eCrime accounted for 82 per cent of observed malicious behaviour against the legal sector.
The second most critical threat was perceived to be the China-nexus espionage. Hacking groups, namely WARP PANDA, TITAN PANDA, MURKY PANDA and OVERCAST PANDA ran unceasing campaigns targeting legal enterprises.
According to the findings, TITAN PANDA made the first observed attack on legal-specific software, exploiting Intapp Time Server, a tool law firms use for timekeeping and billing.
Cyber criminals are manipulating stolen information, social engineering and weaknesses in high-quality legal systems to gain entry to confidential data. Some hackers seemed to have recruited individuals to impersonate IT staff and physically enter law firms.
Recent findings involving US law firms and the UK Legal Aid Agency also demonstrate the possible repercussions of compromised confidential information, demonstrating the evolving cybersecurity threats facing the legal sector.
Attack Attempts Surged By 129% in 8 Months
CrowdStrike discovered numerous financially driven cybercriminal groups targeting legal firms, including CHATTY SPIDER, SNARKY SPIDER and CORDIAL SPIDER.
CHATTY SPIDER’s “activity surged 129 per cent in the first eight months of 2026” in comparison with all of 2024. 90 per cent of its victims during the reporting period were Law firms, according to CrowdStrike.
Social engineering continues to pose a significant risk. This is because it takes advantage of trust rather than depending on technical vulnerabilities. Threat actors have been known to impersonate IT employees or clients to encourage staff to reveal data, approve entry, or send credentials beyond the company’s internal systems.
One such incident this year involved recruiting an individual to pose as an internal IT staff member who managed to gain physical access to a US law firm. The impostor tried to enter the law firm’s internal systems.
In another circumstance, the hacking group attempted to extract sensitive information just four minutes after gaining access.
Such cases reveal how quickly a cyberattack goes from granting unauthorised access to attempting data theft.
89% Increase in ‘AI-Enabled Adversaries’
The recent CrowdStrike Threat Report found that cyberattacks by ‘AI-enabled adversaries’ surged by an astounding 89 per cent in 2025 compared to the year before. Additionally, adversaries exploited legitimate generative AI tools at more than 90 organisations, injecting malicious prompts to steal credentials.
With AI in the picture, the attack surface has become more complex than ever before. AI access is enabling cybercriminals to create an increasing number of credible messages, impersonate work environment language and examine breached data to detect other potential vulnerabilities.
Rebecca Rakoski, Co-Founder and Managing Partner at XPAN Law Partners, told LAW360 Pulse:
“AI makes it easier for a hacker in another country to sound like they're the lawyer two floors down from you, or a client asking for information.”
Alluding to the increased volume of cyberattacks against the legal sector, Scott Bailey, Managing Partner at digital forensics firm N1 Discovery, describes the scene as “the Wild West.”
Bailey explained how AI could make it “easier” for cybercriminals to compromise information. In the past, cyberattacks were a time-consuming process because threat actors manually scanned a compromised mailbox for crucial data. However, the use of AI has enabled threat actors to accelerate cyberattacks.
“Now they just download the mailbox, they point AI at it and say, ‘analyze this mailbox and tell me some attack vectors,’ and 10 minutes later, or 10 seconds later, depending on how big the mailbox is, they've got an attack already lined up,” said the Managing Partner.
This describes how AI aids cybercriminals in examining stolen credentials and locating possible openings efficiently. Cybersecurity defenders now have less time to detect and act on malicious activities, making it harder for the experts to prevent and spot suspicious behaviour.
Employees can be vulnerable to malicious attempts enabled by threat actors using AI. Frank Gillman, principal at Vertex Advisors, explained to Law360:
“Social engineering doesn’t exploit stupidity. What it exploits is trust, urgency and authority. Each of those things is normal human behaviour.
It’s not just a hypothetical risk. According to Law360 Pulse, in 2026, a cybercriminal posed as an IT help desk employee at US law firm Seyfarth Shaw and convinced a member of staff to email client documents to an outside account.
In another case, it was reported by Reuters on October 9, 2026, that Holland & Knight and Squire Patton Boggs had revealed information about cybersecurity breaches involving disclosed Social Security numbers. Holland & Knight stated that a cybercriminal had utilised social-engineering methods to achieve remote access to a company computer.
These incidents signify how cybercriminals can expose regular workplace systems without automatically causing disruptions to a firm's everyday operations.
Why Are Law Firms at Risk?
Law firms rely on software designed to manage billing and case files. These systems hold confidential information and highly sensitive client data, making them attractive targets for exploitation.
CrowdStrike reported the first known case of software exploitation targeting the legal sector. In this incident, TITAN PANDA, a China-nexus cybercriminal group, took advantage of a weakness in Intapp Time Server, which is a management and billing application used by law firms.
Other incidents demonstrate how large identity-based cyberattacks can be. According to the recent report, MURKY PANDA went after nearly 500 accounts at one US law firm, using around 300 IP addresses over 30 days.
SNARKY SPIDER and CORDIAL SPIDER also targeted law firms utilising identity-based methods such as voice phishing and phishing pages that mimic single sign-on. CrowdStrike reported that both groups attacked the same organisation within a month.
WARP PANDA, meanwhile, exploited an unpatched vulnerability in VMware ESXi infrastructure to gain unauthorised access.
These discoveries indicate how cybercriminals can expose vulnerabilities in a range of technologies that support legal procedures, rather than targeting a single staff member alone.
The challenge for law firms is understanding how much access employees, software applications and external providers have to sensitive data. An account holding unnecessary amounts of authorisations, or an unpatched application, can generate a gateway that discloses more information than needed.
Cybersecurity methods therefore must include identity management procedures, multi-factor authentication (MFA), remote access, software updates and supervision on internal and cloud systems.
What Do the Latest Breaches Mean for the UK Legal Sector?
The United States is not the only nation that is experiencing a surge in cyberthreats against its legal sector. UK legal institutions have also been confronted with incidents involving breaches of sensitive data.
Earlier yesterday [October 29], Reuters reported that two major US law firms, Baker McKenzie and Troutman Pepper Locke, “disclosed cyber breaches to US state enforcement authorities.”
Baker McKenzie told California authorities that cybercriminals had “socially engineered two of our users” to gain access to some of their documents. The law firm told authorities it had “no evidence” that the cybercriminals had compromised “user credentials or additional user accounts.”
Troutman Pepper Locke also reported a social engineering case. According to its discovery, an “employee mistakenly sent certain documents to an unauthorised person” owing to an interaction with a cybercriminal.
The newest revelations strengthen how cybercriminals can exploit staff trust and day-to-day document-sharing procedures to steal sensitive data. They highlight how socially engineered cyber threats have affected key international legal institutions.
In the UK, the Legal Aid Agency (LAA) provided updates on its 2025 cyberattacks on October 14, 2026. The LAA confirmed that around “250,000 records” dating from before 2007 had been breached, with the “earliest record currently verified dates from 1978.” Its analysis also recognised data involving HM Prison and Probation Service within the “material exfiltrated during the same cyber-attack.”
The LAA said: “We have no indication that the stolen data has been published or shared.”
Though the LAA is a government agency, not a private law firm, the case reveals the sensitivity and longevity of information held across the wider legal system. Records connected to legal aid applications, payments and cases can remain relevant for decades.
The LAA is a government agency, not a private law firm. While this case shows how sensitive and long-lasting data in the legal system can be, records about legal aid applications, payments, and circumstances may stay significant in the future.
Previously, the National Cyber Security Centre (NCSC) warned that legal organisations become “attractive targets” due to the information they handle. Former NCSC chief executive Lindy Cameron said:
“The UK legal sector carries out essential work to uphold our society; however, we know the sensitive data legal firms handle can make them attractive targets to online attackers.”
The warning demonstrates why legal enterprises must handle cybersecurity as an ongoing urgent priority instead of a problem responded to only after a cyberattack.
CrowdStrike recommends strengthening MFA, remote-access controls and improving data-access governance. Law firms must also be prepared for cyberattacks that involve data theft, blackmail and system disruptions.
Adam Meyers, head of counter adversary operations at CrowdStrike, warned that it is becoming more common for cybercriminals to conjoin digital and physical methods. He said:
“We’re seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion.”
As identity-based techniques, AI-assisted social engineering and weaknesses in high-quality legal systems become more common, law firms face a risk that could expand to different networks.
The challenge is not only avoiding unauthorised access for firms that work with confidential data. It is also about locating any suspicious activity rapidly, preventing the access cybercriminals can gain and protecting important data that clients and law firms heavily depend on.
Comments ( 0 )