WASHINGTON — Cyberattacks on law firms have doubled since 2023, according to a new report from cybersecurity firm CrowdStrike released on Wednesday, October 28, 2026, which warns that criminals are now using AI-driven "agentic" technology — and even recruiting people to physically infiltrate offices — to steal the confidential client secrets that make law firms, in the report's words, "the new ATM for cybercriminals."
Illustration: A modern law office at night, with a laptop glowing with a digital padlock symbol.
What Happened
CrowdStrike's 2026 Legal Threat Landscape Report, covering a one-year period up to August 2026, found that cyber adversaries named 455 legal entities on websites used to post hacked materials — a 39 percent increase on the prior year. The report, released on Wednesday, describes a sector under sustained assault from two directions at once: profit-motivated "e-crime" groups seeking extortion payouts, and nation-state-linked adversaries hunting for strategic intelligence.
The most striking finding is the role of agentic AI — software that can carry out tasks with limited human direction. "What we're seeing across the broader threat landscape, more and more threat actors are using agentic technology to democratize hacking," Adam Meyers, CrowdStrike's senior vice president for counter adversary operations, told Reuters. "It's going to get a lot worse before it gets better."
The report also documents a blurring of digital and physical attacks. "We're seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks," Meyers said in the company's announcement. In one case cited by CrowdStrike, an adversary attempted to steal sensitive data just four minutes after gaining initial access — a measure of how fast modern intrusions can move once a foothold is gained.
Background
Law firms are unusually attractive targets because of what they hold. A single firm may store corporate client communications, merger and acquisition details, intellectual property, government matters and financial records — material that can be sold, leaked or used to pressure victims into paying ransoms. Unlike a retailer, whose stolen data may be limited to card numbers, a law firm's files can reveal a client's negotiating position, a pending deal or an unannounced lawsuit.
Reuters has reported that a growing number of law firms were hit with cyber breaches in recent months, including Quinn Emanuel, WilmerHale and Seyfarth. The CrowdStrike report itself does not name any specific law firm, legal department or legal industry vendor that was exploited, but its aggregate numbers suggest those cases are part of a much wider pattern rather than isolated incidents.
The report breaks the threat into distinct groups. Financially motivated "Big Game Hunting" adversaries accounted for the majority of observed activity against the legal sector, exploiting the highly confidential nature of client information to maximise extortion pressure. Identity-based attacks also expanded: groups tracked as SNARKY SPIDER and CORDIAL SPIDER targeted law firms through trusted access to software-as-a-service applications for data theft and extortion, with both groups targeting the same law firm just one month apart.
China-linked groups feature prominently as an espionage threat. The report said China-linked groups likely will remain the greatest intelligence collection threat to the legal sector, and that China-nexus adversary diversity in the sector doubled. It cited TITAN PANDA conducting the first observed exploitation of legal-sector-specific billing software, WARP PANDA leveraging a software flaw known as an ESXi zero-day for covert access, and MURKY PANDA conducting large-scale password spraying — targeting nearly 500 accounts at a single United States law firm from 300 internet addresses over 30 days.
Illustration: A hooded figure typing at a glowing computer in a dark room, a symbol of the cyber threat facing law firms.
Why It Matters
The findings matter far beyond the legal profession. When a law firm is breached, the victims are often its clients — companies whose deals, disputes and secrets are exposed, and individuals whose private matters become bargaining chips. A leak of merger documents can move share prices; a leak of litigation strategy can decide a case before it reaches court; a leak of government-related work can touch national security.
The rise of agentic AI raises the stakes further. If AI agents can automate the labour-intensive parts of hacking — scanning for weaknesses, crafting phishing messages, moving through networks — then smaller criminal groups can mount attacks that once required skilled teams. That "democratisation" of hacking, as Meyers put it, helps explain why attacks on a once-niche target like law firms have doubled in three years, and why defenders expect the trend to continue.
The physical-infiltration finding is a warning to firms that still treat security as a purely technical problem. A recruited insider, a fake contractor or a visitor with a planted device can bypass firewalls entirely. As Meyers put it, defenders now need visibility across identities, endpoints and cloud environments to detect and disrupt operations before access turns into extortion.
What Happens Next
CrowdStrike's advice points to a broader shift in how professional firms must defend themselves: tighter control over who can access what, stronger identity checks for cloud applications, faster detection of unusual logins, and rehearsed incident-response plans for the moment — not the week — after a breach. The four-minute exfiltration attempt in the report shows that response times measured in days are no longer enough.
Regulators and insurers are also likely to take note. Law firms handle material subject to attorney-client privilege, and a breach can trigger notification duties, malpractice exposure and client claims in addition to the ransom itself. As attacks grow, clients conducting due diligence on their advisers may increasingly ask hard questions about cyber defences before entrusting a firm with sensitive work.
For the wider technology debate, the report feeds into a growing argument that AI agents need guardrails of their own. The same agentic capabilities being marketed as productivity tools for businesses are, according to CrowdStrike, already being turned into hacking tools — a dual-use problem that policymakers, vendors and security firms will be wrestling with well beyond this week's headlines.
Illustration: A glowing digital shield protecting confidential documents, with the scales of justice beside it.
Sponsored: explore today's featured sponsored offers
FAQ
What did CrowdStrike's 2026 report find about law firm cyberattacks?
Attacks on law firms and other legal industry entities have doubled since 2023, according to CrowdStrike's 2026 Legal Threat Landscape Report, which covers a one-year period up to August 2026.
How many legal entities were named on leak sites?
Cyber adversaries named 455 legal entities on websites used to post hacked materials, up 39 percent from the prior year, the report found.
Why are law firms such attractive targets?
Law firms hold corporate client communications, merger and acquisition details, intellectual property, government matters and financial records — material that can be sold, leaked or used to pressure victims into paying ransoms.
What is "agentic AI" and why does it matter for hacking?
Agentic AI refers to software that can carry out tasks with limited human direction. CrowdStrike says threat actors are using it to conduct increasingly sophisticated and efficient attacks, effectively democratising hacking.
What are firms advised to do?
CrowdStrike advises defenders to maintain visibility across identities, endpoints and cloud environments, tighten identity checks for cloud applications, and detect and disrupt intrusions before access turns into extortion.
Sources
- Reuters, "Researchers warn of surging law firm cyber attacks fueled by AI," October 28, 2026
- CrowdStrike, "CrowdStrike 2026 Legal Threat Landscape Report: Cybercriminals Blur Digital and Physical Lines in Attacks on U.S. Law Firms," October 28, 2026
- Business Wire, "CrowdStrike 2026 Legal Threat Landscape Report," October 28, 2026
Comments
Post a Comment