New cybersecurity research reveals a sharp rise in attacks on law firms, with confidential client information increasingly targeted by criminals and state-backed hackers.
But one cybersecurity expert questions to us whether artificial intelligence deserves much of the blame.
Law firms have become increasingly attractive targets for cybercriminals, with attacks on the legal sector nearly doubling since 2023, according to new research reported by Reuters.
The findings come from the CrowdStrike 2026 Legal Threat Landscape Report, released on October 28.
The report paints an uncomfortable picture for law firms already struggling with cybersecurity risks, increasingly sophisticated criminals and the growing use of artificial intelligence.
Researchers found that 455 legal organisations were named on criminal data leak websites between September 2025 and August 2026, an increase of 39 percent over the previous reporting period.
Financially motivated criminals accounted for 82 percent of the malicious activity observed by CrowdStrike.
The problem for law firms as targets for cyber criminals is that they hold confidential client communications, merger negotiations, intellectual property, financial records and sensitive litigation information.
Such information offers opportunities for extortion and for state-backed hackers, it can provide valuable commercial and political intelligence.
Hackers Are Getting Faster
The Reuters report highlights another growing concern, which is that AI is making sophisticated cyberattacks easier and faster to execute.
CrowdStrike identified one criminal group, known as CHATTY SPIDER, whose activity targeting legal organisations increased 129 percent during the first eight months of 2026 compared with the whole of 2024.
In one incident, criminals recruited someone to impersonate an IT employee and physically infiltrate law firm premises.
In another, attackers attempted to steal sensitive data just four minutes after gaining access.
The report also identified an attack exploiting a vulnerability in legal-sector billing and timekeeping software.
China-linked hacking groups present a separate threat, with researchers reporting increasingly sophisticated intelligence-gathering operations against legal organisations.
But Is AI Getting Too Much Blame?
Not everyone agrees that artificial intelligence is the main reason behind the surge.
Dr Ilia Kolochenko, (pictured) founder of cybersecurity company ImmuniWeb and a lawyer specialising in cybersecurity and data protection, argues that the AI explanation risks overlooking more established threats.
“While the numbers in the report seem to be perfectly valid, the root cause analysis seems a bit flawed,” he told LawFuel following the report’s release.
Kolochenko says sophisticated criminal groups and professional hackers have long possessed the tools needed to penetrate valuable targets.
AI may accelerate parts of their operations, but it does not necessarily transform their capabilities.
He also distinguishes these targeted operations from less sophisticated attacks against poorly protected organisations.
His conclusion is that law firms remain highly desirable targets, regardless of developments in AI.
“The use of AI by attackers is not a major contributor to the trend,” he said.
The Real Problem for Law Firms
Law firms possess information that criminals want, while their systems and employees provide multiple potential routes of attack.
CrowdStrike recommends stronger multifactor authentication, tighter remote-access controls, improved monitoring and better protection of sensitive data.
The research also suggests that firms need to prepare for increasingly rapid attempts to steal information, rather than focusing solely on traditional ransomware attacks.
The central warning is straightforward – law firms are being targeted more frequently, attackers are moving faster, and confidential client information remains the prize.
Whether AI is responsible for the increase may be debatable. The scale of the threat is not.
Sources: Reuters, October 28, 2026; CrowdStrike 2026 Legal Threat Landscape Report; comments supplied to LawFuel by Dr Ilia Kolochenko.
