Law Firm Cybersecurity2026-10-28By Tyson Benson

Law Firm Cyberattacks: Less Time to Protect Client Files

Reuters highlights rising law firm cyberattacks. New research shows why firms should verify remote access, client-file permissions, and incident response now.

Get your free review Explore the Security Baseline

Four minutes after gaining access, attackers were already attempting to steal sensitive data.

That is but one intrusion described in CrowdStrike’s October 28 release on threats to the legal sector. As a managing partner or an office administrator are you ready because an incident may move faster than the time it takes to find your IT provider’s number.

For smaller firms, the practical question is immediate: if someone gains access to one employee’s computer or account, what stands between that access and your client files?

The answer starts outside your office, with what an attacker can learn about your firm before the first call.

What the new findings show

CrowdStrike’s public report summary says cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026. It also reports that extortion groups named 455 legal entities on data leak sites between September 2025 and August 2026, a 39% year-over-year increase.

CrowdStrike attributes the four-minute example to CHATTY SPIDER, a group that impersonates IT staff to start remote access sessions. It says law firms made up nearly 90% of that group’s victims during the reporting period.

Those figures need context. Leak-site listings are criminal claims, not independently confirmed breach findings for every named organization. The findings also do not establish an individual small firm’s likelihood of being attacked.

The four-minute example is one reported intrusion, not an average response window. But it illustrates why controls that already restrict access matter: a firm may have little time to intervene once an attacker gets in.

Keep the AI warning in perspective

In its analysis accompanying the report, CrowdStrike warns that advancing AI capabilities are likely to accelerate attackers’ operations. That is a forward-looking assessment. The published findings do not establish that AI caused the reported increase or that every incident involved AI.

The access problem is already observable. Mandiant’s June 2026 research on the same group, which it tracks as UNC3753, describes attackers posing as IT support. They persuade employees to join screen-sharing sessions and use remote access tools, then search for sensitive information.

In many incidents Mandiant investigated, the sequence from first contact to theft and extortion happened within one business day.

The attack starts with public information

Fast intrusions usually begin with slow, quiet research. Mandiant notes that this group often gathers staff names and contact details from organizations’ websites before it calls.

CrowdStrike describes two newer groups, SNARKY SPIDER and CORDIAL SPIDER, that pair fake IT calls with phishing pages imitating a single sign-on screen. That is the page staff use to log in to their work accounts.

Other attackers go straight to public sign-in pages. CrowdStrike reports that one law firm saw failed login attempts against nearly 500 accounts from about 300 IP addresses in 30 days. This is password spraying: trying common passwords across many accounts.

Each of these attacks uses information anyone can find. That includes who works at your firm, which sign-in and remote access pages are reachable online, and how easily your domain can be imitated.

Most firms have never looked at that outside view. None of it proves a weakness on its own. It shows where an attacker would start.

Inside the firm, the priority is to verify who can obtain access, what they can reach, and who will act when something looks wrong.

Working computers do not mean client files are safe

The FBI’s May 26 advisory on Silent Ransom Group, another name for the same group, describes data theft and extortion without traditional ransomware encryption. It warns of fake IT support calls and individuals visiting offices to gain access to computers.

CrowdStrike describes one such case. In November 2025, a recruited individual posed as internal IT staff at a U.S. law firm and was given access to an onsite workstation.

That distinction matters. Backups can help restore unavailable files. They cannot retrieve copies an attacker has already taken.

Consider an illustrative small-firm scenario: an employee accepts a convincing support request and starts a remote session. If that computer can open every active matter folder, the attacker may inherit access far beyond the employee’s current assignment. The firm’s systems could remain usable while confidential documents leave its control.

Five things your firm should verify this week

1. Require a separate check before granting support access

Give everyone a known support number or approved ticketing route. Require staff to confirm unexpected requests through that channel before starting a remote session, sending documents, or letting a visitor use a computer.

Use your IT support verification checklist and callback script to practice the conversation.

Also note which staff names, roles, and direct phone numbers your website publishes. You may still need them listed. Staff in those roles should expect convincing calls.

2. Check which remote access tools can actually run

Ask whoever manages your devices for the approved tools, who may authorize a session, and what restricts unapproved tools. Request evidence of the settings and a recent review of installed software.

A legitimate support application still needs an authorized operator and purpose.

3. Review what one compromised account could reach

Have the person managing your document system review a typical employee’s matter access, broad shared folders, and external sharing links. Identify permissions that exceed the person’s work and assign an owner to correct them.

Your Microsoft 365 security checklist can guide the broader review.

4. Find out who receives alerts—and when

Ask which events generate alerts, such as new remote access software, unusual sign-ins, or large downloads. Confirm who reviews them, the hours covered, and who can disable an account or isolate a device.

Request a recent alert example or an authorized demonstration. A monitoring subscription alone does not explain the response process.

5. Rehearse the first call

Run a short exercise: “An employee says someone claiming to be IT just controlled their computer.” Have the team locate the response contact, explain how to report the incident, and identify who can initiate containment and preserve evidence.

Record unclear responsibilities and fix them before the next exercise. The law firm incident response plan template includes a short tabletop exercise you can adapt.

See what attackers can see first

The five checks above happen inside your firm. Before that work starts, look at your firm the way an outsider does.

The Free Zero-Access Exposure Review™ needs only your firm’s domain and a matching work email. It looks for remote access and sign-in addresses listed in public DNS or certificate records. It also checks look-alike versions of your domain, email settings that make your domain harder to impersonate, and website security signals.

The verification link goes only to that work inbox. Results appear in your browser, and the completion email includes a one-page PDF when one can be generated. We do not keep the report or scan findings. We keep only your email so we can follow up.

The review checks only what is visible from outside. It does not test internal access, installed remote access tools, staff responses, or client-file permissions.

Turn the findings into a plan

Choose one person to collect the review results, the answers to the five checks, and any unresolved gaps. Set a date to review the highest-priority changes with firm leadership and whoever manages your systems.

If you want an independent view, contact us to talk through what you found. The Law Firm Security Baseline works alongside your existing IT provider. It reviews evidence across identity, email, devices, core systems, and readiness.

The Baseline gives leadership a prioritized view of what is working, what needs attention, and what remains unverified. Configuration changes and remediation are scoped separately.

If AI headlines prompted the question, AI-era threat readiness maps what has changed, what still works, and which controls need redesign.

Sources

This article provides general cybersecurity information and does not constitute legal or compliance advice.