Researchers warn of surging law firm cyber attacks fueled by AI
XLK•Cyberattacks on law firms and other legal industry entities have doubled since 2023, CrowdStrike’s report said. It identified 455 legal entities named on sites used to post hacked materials, up 39% from the prior year.
1. Attacks on legal entities rise
CrowdStrike’s 2026 Legal Threat Landscape Report, covering the year through August 2026, said adversaries named 455 legal entities on websites used to post hacked materials, a 39% increase from the prior year. CrowdStrike executive Adam Meyers said more threat actors are using agentic technology to make hacking more accessible and warned, “It’s going to get a lot worse before it gets better.”
2. Threats and defenses
The report cited profit-motivated groups and nation-state adversaries, and said China-linked groups likely will remain the greatest intelligence collection threat to the legal sector. It also described a first instance of an entity targeting legal-industry software, exploiting a vulnerability in software used for law firm timekeeping and billing. CrowdStrike recommended stronger multifactor authentication, tighter controls over remote access tools, improved data access governance and monitoring for unusual access.
