Leak-Site Listings of Law Firms Jumped 39%. Why Outside Counsel Belongs in Your Vendor Risk Program

Criminal extortion groups publicly named 455 legal organizations on their data leak sites in the year to August 2026, up 39 percent year over year (which implies roughly 327 the year before), according to CrowdStrike’s 2026 Legal Threat Landscape Report, released on October 28. The same report says intrusions targeting the legal sector have nearly doubled since 2023, and it describes one criminal group going as far as paying a person to walk into a U.S. law firm, pose as IT staff and sit down at a workstation.

For law firms, those numbers describe their own risk. For everyone else, they describe a third-party risk that rarely gets the scrutiny given to cloud providers and payment processors. Outside counsel holds merger plans, litigation strategy, regulatory correspondence, employee investigations and, very often, large volumes of personal data produced in discovery. When a firm is breached, the client’s data is breached too, and the client may find out from a leak site before it hears from its lawyers.

What the 39 percent figure measures

Headlines have summarized the report as a 39 percent rise in cyberattacks on law firms. That is not quite what it says, and the difference matters for anyone citing it in a board paper or a risk assessment.

The 39 percent figure counts legal entities that “big game hunting” ransomware and extortion groups named on their dedicated leak sites between September 1, 2025, and August 31, 2026. A listing is a public claim by criminals that they hold a victim’s data. It is not an independently verified breach, and it says nothing about whether a ransom was paid. The count also covers “legal entities,” which can include legal departments and legal-industry vendors as well as firms. The separate finding that intrusions roughly doubled from a 2023 baseline comes from CrowdStrike’s own threat-hunting and intelligence work, which means it reflects what the company can see across its customers and investigations rather than a census of the whole sector.

None of that makes the trend less real. It means the honest description is that extortion listings of legal organizations rose 39 percent, and that a major security vendor sees roughly twice as many intrusion attempts against the sector as it did three years ago. CrowdStrike also sells the services its report recommends, which is worth keeping in mind, though the specific incidents it describes are concrete and checkable against other reporting.

Who is attacking, and how

According to CrowdStrike’s summary of the report, financially motivated criminals accounted for 82 percent of the malicious activity it observed against legal entities. The rest came largely from state-linked espionage groups, and the two have very different goals.

Criminal groups: social engineering, then speed

The group CrowdStrike calls CHATTY SPIDER leads the pack. Its activity against legal entities grew 129 percent in the first eight months of 2026 compared with all of 2024, and law firms made up nearly 90 percent of its victims in the reporting period. It targets U.S. firms almost exclusively. The playbook starts with a call or message impersonating the firm’s IT staff, persuades an employee to open a remote access session and then moves data out within minutes, increasingly through legitimate enterprise tools that blend in with normal traffic. In one intrusion, CrowdStrike says the group attempted to exfiltrate data four minutes after gaining access.

The physical intrusion is the detail that will change some firms’ security planning. In November 2025, CrowdStrike says, CHATTY SPIDER hired a Russian national to visit a U.S. law firm while posing as an internal IT employee. He was given access to a workstation, installed remote monitoring and management tools and tried to move data out through cloud storage. He was detained on a second visit. Public reporting, CrowdStrike adds, indicates the group used U.S.-based individuals for several more physical intrusions in 2026.

Two newer groups, SNARKY SPIDER and CORDIAL SPIDER, use near-identical methods: voice-phishing calls impersonating IT and links to fake single sign-on pages, followed by theft from the SaaS applications those credentials unlock. In one case both hit the same firm a month apart.

State-linked groups: zero-days and legal-specific software

China-linked groups were the main espionage threat, and CrowdStrike says nearly twice as many of them targeted the legal sector as in 2023. Their methods were more technical. WARP PANDA exploited a zero-day in VMware ESXi to get covert access. TITAN PANDA exploited a hardcoded machine-key vulnerability in Intapp Time Server, timekeeping and billing software used almost exclusively by law firms, which CrowdStrike calls the first observed targeting of legal-sector-specific software. MURKY PANDA’s password-spraying campaign hit one firm with nearly 500 failed logins against as many accounts from about 300 IP addresses over 30 days. OVERCAST PANDA targeted executives at a U.K. firm.

Where does AI fit? Adam Meyers, who leads CrowdStrike’s counter adversary operations, told Reuters that “more and more threat actors are using agentic technology to democratize hacking,” and added: “It’s going to get a lot worse before it gets better.” The report itself frames AI as an accelerant that will compress the time from access to theft. It does not attribute the 39 percent rise to AI, and readers should not either.

The ethics rules already cover this

Law firms do not need a new regulation to be on the hook. The American Bar Association’s Model Rules, adopted in some form in every U.S. jurisdiction, already set the standard, and the ABA spelled out the breach implications in Formal Opinion 483 in 2018.

• Competence (Rule 1.1, Comment 8). Lawyers must keep abreast of the benefits and risks of relevant technology.
• Confidentiality (Rule 1.6(c)). Lawyers must make reasonable efforts to prevent unauthorized access to client information. A breach is not automatically a violation if those efforts were reasonable, judged by factors including the sensitivity of the information and the cost and difficulty of safeguards.
• Supervision (Rules 5.1 and 5.3). Firm managers must have measures giving reasonable assurance that lawyers, staff and outside vendors comply. Opinion 483 reads this as requiring reasonable efforts to monitor technology, external data sources and vendors.
• Communication (Rule 1.4). When a breach involves, or has a substantial likelihood of involving, material client information, lawyers must notify current clients, tell them what is known about the extent and keep them informed as the investigation develops.

Two points in Opinion 483 deserve more attention than they get. First, the ABA said compliance with state breach statutes, HIPAA or Gramm-Leach-Bliley does not necessarily satisfy the ethics rules, and vice versa; each needs its own analysis. Second, it encouraged firms to limit the client and personal data they keep and to follow a retention schedule, noting that data protection laws or contracts may require notice to former clients even where the ethics rules do not. Every closed matter file that should have been returned or destroyed is something an extortion group can still post.

Clients have started to enforce these expectations through the courts as well. We have tracked class actions against firms including WilmerHale and Blank Rome, and the run of disclosures we covered when Herbert Smith Freehills Kramer, Goodwin Procter and others reported breaches. Reuters has reported breaches at Quinn Emanuel, WilmerHale and Seyfarth Shaw in recent months; the CrowdStrike report itself names no victims.

Eight things to do before the next vishing call

CrowdStrike’s own recommendations, as reported by Reuters, center on stronger multi-factor authentication, tighter control of remote access tools, better data access governance and monitoring for unusual data access. Here is how that translates for the two audiences most affected.

For law firms

1. Make IT verification a process, not a judgment call. No employee should grant remote access or reset credentials because a caller says they are from IT. Require a call-back to a known number or a ticket in the firm’s system, and train front-desk staff that the same rule applies in person.
2. Lock down remote monitoring and management tools. Allow only the RMM products the firm actually uses, block the rest, and alert on any new installation. CHATTY SPIDER’s intrusions depend on getting one installed.
3. Move to phishing-resistant MFA for SSO. Push-notification and code-based MFA can be relayed through fake SSO pages. Hardware keys and passkeys are much harder to phish.
4. Treat practice-management and billing software as crown jewels. The Intapp case shows attackers now study legal-specific tools. Patch them quickly, keep them off the open internet where possible and include them in vulnerability scanning.
5. Shrink what can be stolen. Apply retention schedules to closed matters and discovery productions, and return or destroy client data at the end of engagements as Opinion 483 encourages.

For in-house legal and privacy teams

6. Put outside counsel in the vendor risk program. Firms that hold personal data on your behalf are service providers or processors in substance, whatever the engagement letter says. Send them the same security questions you send other vendors, scaled to the sensitivity of what they hold.
7. Write breach terms into engagement letters. Agree on how quickly the firm must tell you about an incident affecting your data, who will be told, and what happens to your data at the end of the matter. Your own notification clocks under state law, GDPR or sector rules may start when you learn of it, not when the firm finishes investigating.
8. Map what you have sent out. Keep a record of which firms received which categories of personal data, especially in litigation and investigations. If a firm appears on a leak site, you will need to know within hours whether your employees’ or customers’ data was in scope.

The contract and insurance side of this is often the weakest link; our piece on breach liability, vendor contracts and the insurance gap walks through the gaps that tend to surface only after an incident.

The AI angle inside the firm

There is a second way AI raises the stakes. Firms are concentrating more client data in AI platforms for review, drafting and research, which can turn a single compromised account into access to far more documents than a traditional file share would expose. We looked at that consolidation risk in when law firms become AI platforms. The same access controls, logging and retention rules that apply to document management systems need to follow the data into those tools.

Captain Compliance works with law firms on the privacy-technology side of this picture rather than network defense. Its legal solutions cover technical privacy audits of client websites, tracker and consent testing, and evidence for counsel in privacy litigation. That is relevant where firms advise clients on tracking and data-sharing claims, but it is not a substitute for endpoint, identity or incident-response tooling, and no product can promise a firm will not be breached.

Frequently asked questions

Did cyberattacks on law firms really rise 39 percent?

The 39 percent figure is the rise in legal entities named on criminal leak sites, to 455 from an implied prior-year count of roughly 327 (CrowdStrike publishes the 455 figure and the 39 percent rise), between the year to August 2025 and the year to August 2026. CrowdStrike separately reports that intrusions against the sector nearly doubled from a 2023 baseline. Leak-site listings are criminal claims, not verified breach counts.

Is a law firm automatically in breach of its ethics duties if it is hacked?

No. Under ABA Model Rule 1.6(c) and Formal Opinion 483, unauthorized access is not a violation if the lawyer made reasonable efforts to prevent it. But the duty to notify affected current clients applies regardless of how good the firm’s security was.

Must a firm notify former clients?

The ABA declined to require it under the Model Rules, but noted that data protection laws, common-law duties and contracts may require notice to former clients. State breach statutes can also apply to any individual whose personal information was exposed.

Why are law firms such attractive targets?

They hold privileged communications, deal information, intellectual property and financial records for many clients at once, and clients are highly motivated to keep that material private. That makes extortion more effective and makes a single firm a gateway into many organizations.

What is the single most useful control against the groups in this report?

There is no single control, but the criminal groups CrowdStrike describes rely heavily on convincing staff to grant remote access to a fake IT caller. Strict verification of IT requests, combined with tight control of remote access tools and phishing-resistant MFA, blocks the most common path described.

The client will ask first

For years, the security questionnaire has flowed from law firm to client, with firms asking companies about their data practices before advising them. The CrowdStrike numbers suggest that flow is about to reverse in earnest. General counsel who have watched peer firms appear on leak sites are going to ask their own outside counsel what happened to the last matter file, who can open a remote session on the billing system and how quickly they will be told if something goes wrong. Firms that can answer in writing will keep the work. The ones that cannot may learn that the most expensive breach is the one that ends a client relationship before any regulator gets involved.