Attacks on law firms keep rising: what CrowdStrike's 2026 legal sector report found

Informational only, not legal advice. TacticalMS is not a law firm. Read more.

CrowdStrike's 2026 Legal Threat Landscape Report, released October 28, 2026, says attacks on law firms are growing and that attackers are mixing online intrusions with in-person tactics ¹. The report says 455 legal entities were named on data leak sites, a 39% increase year over year, and that financially motivated groups were behind 82% of observed malicious activity against the legal sector ¹. The report covers U.S. law firms generally, so its findings describe the environment Oregon firms work in as well ^{1, 2}.

What the CrowdStrike report found

The findings below are CrowdStrike's own, as stated in its October 28, 2026 press release ¹. CrowdStrike says the report draws on its tracking of "more than 290 named adversaries" ¹.

• Most activity is about money. Financially motivated adversaries accounted for 82% of observed malicious activity against the legal sector, according to the release ¹.
• More firms on leak sites. Ransomware and extortion groups, which CrowdStrike calls "Big Game Hunting" adversaries, named 455 legal entities on data leak sites, a 39% year-over-year increase ¹.
• One group grew sharply. The release says one group's malicious activity grew 129% ¹.
• Speed. In one intrusion described in the release, the attacker tried to remove data four minutes after first getting in ¹.
• Password spraying. The release describes a China-nexus group targeting "nearly 500 accounts at a single U.S. law firm" from 300 IP addresses over 30 days ¹.

Two tactics the report describes

The report describes a blend of physical and digital methods. According to the release, one group "recruited an individual to impersonate IT staff and physically infiltrate law firms to establish remote access" ¹.

The release also describes identity-based attacks on cloud software. Two groups exploited "trusted access to SaaS applications for data theft and extortion," and the release says both "targeted the same law firm just one month apart" ¹. SaaS means software a firm uses over the internet, such as hosted email, document storage or practice management.

The AI angle

CrowdStrike's release ties the time pressure on defenders to AI. It says "as AI capabilities advance that window will only shrink, leaving defenders with less time to stop attacks" ¹.

The ABA Journal covered the report on October 30, 2026, in an article credited to Reuters ². It reported that these attacks "have doubled since 2023" ². The ABA Journal quoted Adam Meyers, CrowdStrike's senior vice president for counter adversary operations, saying that "more and more threat actors are using agentic technology to democratize hacking" ². The article also said CrowdStrike "did not name specific firms or other legal groups as the victims of attacks" ².

The report itself does not include Oregon-specific findings ^{1, 2}.

What official guidance already says

Federal agencies have published plain guidance on the most common scams that target businesses, including law firms that move client money. These are the agencies' own recommendations, not an assessment of any firm's security.

The FBI on business email compromise. FBI Alert I-060923-PSA, issued by the FBI's Internet Crime Complaint Center on June 9, 2023, reported $50,871,249,501 in exposed losses from business email compromise between October 2013 and December 2022 ³. Its tips include:

• "Use secondary channels or two-factor authentication to verify requests for changes in account information" ³.
• Check that links in an email match the business or person they claim to come from, and watch for misspelled domain names ³.
• Never send login credentials or personal information by email ³.
• Check the sender's full email address, especially on a phone ³.

NIST on phishing. The National Institute of Standards and Technology's small business guidance on phishing, updated October 16, 2026, describes phishing as "the use of convincing emails or other messages to trick us into opening harmful links" ⁴. For an urgent message that appears to come from a boss or a vendor, the page says to "verify the request by using known contact information or information from a public company website" ⁴. It also says to "enable multi-factor authentication" and notes that email services can use authentication technologies "that verify where messages originated" ⁴.

NIST's page frames that verification step around messages that appear to come from a boss or a vendor ⁴. For AI tools specifically, our earlier list of questions Oregon firms can ask an AI vendor collects what Oregon State Bar guidance says about vetting outside providers ⁴.

What the report does not settle

The press release and the ABA Journal article do not say which firms were attacked, how the attacks were discovered, or what the affected firms did afterward ^{1, 2}. The figures are CrowdStrike's own observations, not a government count ¹. Questions about what a specific firm must do after a security incident depend on the facts and the law that applies, and are for a licensed Oregon attorney.

Tomorrow's post looks at what Oregon's data breach notice law says and how it applies to firms that hold client information.

Not legal advice. This post is general information about law and technology, not legal advice. It does not create an attorney-client relationship, and TacticalMS is not a law firm. Laws, rules and ethics opinions change; check the cited sources and talk with a licensed Oregon attorney about any specific situation. Researched and drafted with AI tools from the sources above and checked against our editorial standards. Spot an error? Email intake@tacticalms.dev and we'll fix it.