Law-firm cyberattacks doubled since 2023, CrowdStrike report says

CrowdStrike counted 455 legal entities named on hacking leak sites, up 39% in a year, and warned that agentic AI is increasing risks to confidential client data.

jajoy39

Oct 29, 2026 - 10:10

0 2

File photograph of a CrowdStrike office in Silicon Valley. CrowdStrike produced the legal-sector threat report; this is not an image of an attacked law firm. Photo: Getty Images, via Mashable.

Law-firm cyberattacks doubled since 2023, CrowdStrike report says

Cyberattacks on law firms and other legal-sector organizations have doubled since 2023, according to research released by CrowdStrike on October 28, as security specialists warn that agentic artificial intelligence is making attacks easier to carry out.

The company's 2026 Legal Threat Landscape Report found that adversaries named 455 legal entities on websites used to publish hacked material, a 39% increase from the previous year. The report covers a one-year period ending in August 2026.

Valuable client records attract attackers

Law firms hold confidential client communications, merger details, intellectual property, government-related material and financial records. Those holdings can attract criminals seeking money as well as groups seeking strategic intelligence, Reuters reported.

CrowdStrike said the threats include financially motivated groups and state-linked adversaries. Its report expects China-linked groups to remain the legal sector's largest intelligence-collection threat.

Industry-specific software becomes a target

The researchers said they had identified an entity targeting software specifically used by the legal industry for the first time. In that case, attackers exploited a vulnerability in a timekeeping and billing application. The report did not name the affected firm, legal department or software vendor.

Adam Meyers, CrowdStrike's senior vice president for counter-adversary operations, told Reuters that more attackers were using agentic technology to broaden access to hacking. That warning does not establish that AI caused every incident counted in the report.

Stronger access controls are recommended

CrowdStrike urged legal organizations to strengthen multifactor authentication and control remote-access tools. It also recommended tighter data-access governance, monitoring for unusual access, and preparing for data theft, extortion and disruption.