Cyberattacks on law firms and other legal industry entities have doubled since 2023, according to new research from cybersecurity firm CrowdStrike released on Wednesday. The company’s 2026 Legal Threat Landscape Report, covering a one-year period up to August 2026, found that adversaries named 455 legal entities on websites used to post hacked materials — up 39 percent from the prior year.
Law firms are attractive targets because they hold corporate client communications, merger and acquisition details, intellectual property, government matters, and financial records. CrowdStrike says threats come from profit-motivated “e-crime” groups as well as nation-state adversaries, and that China-linked groups will likely remain the greatest intelligence collection threat to the legal sector.
“What we’re seeing across the broader threat landscape, more and more threat actors are using agentic technology to democratize hacking,” said Adam Meyers, CrowdStrike’s senior vice president for counter adversary operations. “It’s going to get a lot worse before it gets better.” Reuters has reported that a growing number of law firms were hit with breaches in recent months, although the CrowdStrike report does not name any specific firm, legal department, or vendor that was exploited.
It is worth pausing on why law firms, of all businesses, attract this level of attention. A single firm may hold one client’s merger plans, another client’s patent filings, and a third client’s litigation strategy — information that is valuable to competitors, useful to hostile governments, and easy to monetise through extortion. Attackers do not need to breach every firm; they need only find the ones whose defences lag behind the value of what they hold.
Why it matters
The legal sector is a canary for every knowledge industry: if firms guarding other companies’ secrets cannot keep attackers out, few organizations can feel safe. The report’s warning about agentic AI matters beyond law firms, too. When attack tools become cheaper and easier to run, the volume of attacks rises even if each individual attack is unsophisticated — and defense has to scale the same way. For any business that shares sensitive documents with outside advisers, the question is no longer whether those advisers are targeted, but how quickly they detect and contain a breach.
There is a practical lesson here for any business that outsources sensitive work. Ask your advisers — law firms, accountants, consultants — what they do when they are breached, not just how they prevent one. Incident response plans, backup discipline, and honest disclosure timelines matter more than any single security product. And if your own industry has not yet seen its version of this report, treat the legal sector’s numbers as an early warning rather than someone else’s problem.
Source: Reuters, October 28, 2026.