Cyber attacks on law firms and other legal industry entities have doubled since 2023, according to research published by cybersecurity firm CrowdStrike on Wednesday, amid growing concerns that threat actors are using agentic artificial intelligence (AI) to carry out increasingly sophisticated and efficient attacks.
CrowdStrike’s 2026 Legal Threat Landscape Report, covering the 12 months to August 2026, said cyber adversaries had named 455 legal entities on websites used to publish stolen data, a 39% increase from the previous year.
Law firms hold sensitive corporate communications, merger and acquisition details, intellectual property, government-related information and financial records, making them attractive targets for criminals seeking financial gain and strategic intelligence.
“What we’re seeing across the broader threat landscape, more and more threat actors are using agentic technology to democratise hacking,” said Adam Meyers, CrowdStrike’s senior vice-president for counter-adversary operations. “It’s going to get a lot worse before it gets better.”
Reuters has reported that a growing number of law firms have suffered cyber breaches in recent months, including Quinn Emanuel, WilmerHale and Seyfarth. CrowdStrike’s report did not identify any specific law firm, in-house legal department or legal industry vendor that had been compromised.
CrowdStrike, based in Austin, Texas, provides cybersecurity software to help businesses protect their computers, cloud systems, accounts and data from cyber attacks.
The report said threats came from a range of sources, including financially motivated cybercrime groups and state-sponsored adversaries. It warned that China-linked groups were likely to remain the biggest intelligence-gathering threat to the legal sector.
For the first time, the report identified an entity targeting software specifically designed for the legal industry. In that incident, hackers exploited a vulnerability in software used by law firms for timekeeping and billing.
In another incident in November, cybercriminals hired a Russian national to enter a US law firm while posing as an internal IT employee.
Several major law firms targeted in recent cyber attacks said they had been victims of social engineering, a form of attack in which criminals manipulate individuals into disclosing sensitive information or granting access to secure systems.
CrowdStrike recommended that law firms and other organisations in the sector strengthen multi-factor authentication and tighten controls over remote-access tools.
The report also called for stronger data-access governance, closer monitoring for unusual access to information and better preparation for data theft, extortion and disruptive cyber operations.
For enquiries or further information, contact ask@tlr.ae or call +971 52 644 3004. Follow The Law Reporters on WhatsApp Channels.