TheCorporateCounsel.net

Earlier this week, I highlighted that October is Cybersecurity Awareness Month and I noted how CrowdStrike’s 2026 Global Threat Report described the growing threat from AI systems, but I failed to mention the threat much closer to home: Cybersecurity threats targeting law firms.

As this Reuters article notes, CrowdStrike highlights ever-increasing security breaches at law firms, which are prime targets given their propensity to be sitting on lots of highly sensitive confidential information while publishing everyone’s email address on a public website. The article notes:

CrowdStrike’s report said threats are coming from entities including profit-motivated “e-crime” groups and nation-state adversaries. The report said China-linked groups likely will remain the greatest intelligence collection threat to the legal sector.

The new report said it ⁠found for the first time an entity targeting legal industry-specific software. The hackers in that instance, the report said, exploited a vulnerability in software that law firms use for timekeeping and billing.

In another episode in November, cyber criminals hired a Russian national to walk into a US law firm while posing as an internal IT employee.

Many major law firms targeted in recent cyber attacks ⁠said they were victims of a “social engineering” event. Such attacks can involve manipulating people into revealing sensitive information or granting access to secure systems.

A not-so-comforting sentiment was shared with Reuters by CrowdStrike’s senior vice president for counter adversary operations:

“What we’re seeing across the broader threat landscape, more and more threat actors are using agentic technology ⁠to democratize hacking,” said Adam Meyers, CrowdStrike’s senior vice president for counter adversary operations. “It’s going to get a lot worse before it gets better.”

If you, like me, are a law firm denizen, let this CrowdStrike report and all of the hoopla around Cybersecurity Awareness Month serve as a wake-up call. We all receive constant warnings from our IT departments about the risk of cyber attacks, but admittedly we get numb to those warnings over time. It is really up to each individual to exercise vigilance and common sense when you receive a random email or a suspicious call. There is a lot at stake, so it really makes sense to be overly cautious when it comes to cybersecurity, particularly as the methods are constantly being advanced with the presence of AI. In short, don’t fall for it!

– Dave Lynn