Law Firm Cyberattacks Doubled: Why Small and Mid-Sized Practices Are Now Primary Targets

Blog post - By Securing Your Law Firm

Get your free review | See the Security Baseline

When corporate legal giants make headlines for data breaches, managing partners at smaller and mid-sized firms often breathe a sigh of relief, assuming attackers are only hunting for Fortune 500 targets.

Recent industry data tells a very different story.

According to Baker & Hostetler's Data Security Incident Response Report, cyber incidents handling legal sector data nearly doubled year-over-year. Specialized ransomware and extortion threat groups - such as Luna Moth (also known as Silent Ransomware or Chatty Spider) - have deliberately shifted focus toward small and mid-sized law firms (ABA Journal).

Why? Because mid-sized firms sit on the exact same high-value client data - M&A deals, financial records, trade secrets, and privileged communications - as major international practices, but often operate with a fraction of the dedicated cybersecurity infrastructure (Kyber Security).

At the same time, cyber liability insurers are tightening their requirements: 60% of small-to-mid firms hit by an attack lack adequate cyber insurance, and carriers are increasingly refusing to payout claims if basic technical controls weren't enforced prior to the incident (Programs.com).

In this article:

• Why threat actors specifically target small and mid-sized law firms
• The primary tactics used in recent legal sector ransomware campaigns
• Why cyber insurers are dropping firms or denying claims after a breach
• How a core security baseline neutralizes the most common attack vectors
• Simple steps your firm can take today to verify its security posture

Why Small and Mid-Sized Law Firms Are in the Crosshairs

A common misconception among managing partners is that cybercriminals only care about volume consumer data or massive corporate networks. In reality, cyber extortion relies on leverage - and law firms carry more inherent leverage than almost any other small business.

A ten-person litigation or transactional practice handles sensitive client financials, intellectual property, medical records, and confidential strategy. If an attacker exfiltrates that data, the firm faces a multi-layered crisis:

1. Reputational & Ethical Exposure: Under ABA Model Rule 1.6(c), attorneys have an ethical duty to safeguard client information. Exposure of client secrets destroys client trust instantly (Attorney at Work).
2. Business Interruption: Modern ransomware doesn't just lock files; it halts daily operations, case management systems, and court filings.
3. Double Extortion: Attackers demand payment once to decrypt files, and a second time to prevent publishing sensitive client records publicly.

Attackers know that smaller firms frequently rely on generalist IT providers who manage basic network uptime rather than specialized cybersecurity enforcement. That gap makes small-to-mid practices prime targets.

How Modern Legal Cyberattacks Actually Happen

The latest wave of attacks targeting law firms relies heavily on social engineering, callback phishing, and credential harvest scams rather than complex zero-day exploits (Attorney at Work):

• Social Engineering & Fake Legal Inquiries: Attackers send convincing emails masquerading as prospective clients, court administrators, or opposing counsel with malicious links or attachments (for example, "Updated Settlement Terms.pdf.exe") (Kyber Security).
• Business Email Compromise (BEC): Infiltrating a partner's or real estate paralegal's email account allows criminals to intercept closing communications and divert wire transfers.
• Callback Phishing (Luna Moth Tactics): Threat actors send fake invoices or subscription renewals prompting staff to call a phone number. Over the phone, scammers trick employees into downloading remote support software, giving attackers direct access to the internal firm network.
• Unenforced Multi-Factor Authentication (MFA): If MFA isn't strictly enforced across every mailbox and remote access point, stolen credentials lead directly to full network compromise.

The Cyber Insurance Trap: Why Claims Get Denied

In previous years, buying a cyber liability policy was straightforward. Today, insurance carriers are incurring heavy losses from ransomware payouts and have drastically overhauled their underwriting requirements.

Recent industry surveys indicate that only 40% of law firms carry cyber insurance (down from 46% in prior years), and only 34% maintain a formal, written incident response plan (Programs.com).

Carriers now require detailed attestations during annual renewals. If your firm checks "Yes" to having Multi-Factor Authentication or verified backups on an application form, but an investigation reveals that admin accounts or remote portals were excluded, the carrier can deny coverage for the entire breach.

Having an informal policy or relying on "our IT guy has it covered" is no longer enough to satisfy underwriters or corporate client security questionnaires.

The Controls That Protect Your Practice

Despite the headlines, defending a small or mid-sized law firm does not require enterprise-scale budgets or overly complex software tools. The vast majority of threats are neutralized by enforcing a consistent set of core technical and operational safeguards:

1. Strict, Universally Enforced MFA: Multi-Factor Authentication must be mandatory across all email accounts, cloud case management software, VPNs, and administrative portals - without exceptions (Kyber Security).
2. Immutable, Tested Backups: Backups must be isolated from the primary network so ransomware cannot encrypt them, and restoration processes must be tested periodically.
3. Written Incident Response Plan: A clear, step-by-step playbook detailing who to contact, how to contain a breach, and when client notification obligations are triggered under state privacy statutes.
4. Endpoint Protection & Patch Management: Modern endpoint detection and response (EDR) software monitored for unusual behavior, combined with regular patching.
5. Targeted Legal-Workflow Training: Staff training focused specifically on wire fraud, fake client intakes, and phone-based social engineering rather than generic compliance videos.

What Your Firm Should Verify Right Now

Before your next insurance renewal or corporate client questionnaire arrives, managing partners should ask four essential questions:

1. Is Multi-Factor Authentication enforced on every single mailbox and admin account across our organization?
2. If our firm suffered a ransomware attack today, do we have an isolated backup that could restore operations within hours?
3. Do we have a written Incident Response Plan that complies with our state's breach notification laws and ethics duties?
4. Can we show documented proof of our security controls to an insurer or prospective client on demand?

If you aren't certain of the answers, addressing these gaps now prevents catastrophic operational and financial exposure down the road.

See Where Your Firm Stands in 2 Minutes

You don't need to commit to a months-long audit to start understanding your firm's security baseline.

Our Free Proprietary Exposure Review analyzes the public-facing technical signals that attackers and cyber insurance underwriters inspect first - including email spoofing vulnerabilities, exposed remote portals, and domain security configuration - in about two minutes, with no password required and zero intrusion into your private client files.

For firms looking to implement complete protection, the Law Firm Security Baseline engagement provides a comprehensive assessment, technical hardening, and a clear, documented readout you can confidently present to insurance carriers and corporate clients.

Start Your Free Proprietary Exposure Review | Explore the Law Firm Security Baseline

This article is informational and does not constitute legal or compliance advice.