Cyberattacks on law firms: When trust opens the door

CrowdStrike reports a substantial rise in observed attacks on the legal sector. For law firms, the most useful question lies behind the statistics: Who can obtain access to client information by claiming to be IT support? Published on 28 October, the 2026 Legal Threat Landscape Report describes how attackers exploit legitimate access and trust in service providers.

What the report actually shows

CrowdStrike reports nearly twice as many observed intrusions targeting the legal sector as in 2023. Its main reporting period runs from 1 September 2025 to 31 August 2026. These figures reflect the security provider’s observations, not a census of every cyberattack on law firms. CrowdStrike’s analysis

Three figures need careful reading:

CrowdStrike provides these figures and comparison periods in its report overview and analysis. They establish neither an individual firm’s likelihood of attack nor a doubling specifically in Germany.

An attack does not always need a software vulnerability

According to CrowdStrike, CHATTY SPIDER almost exclusively targets US law firms. Reported methods include impersonating IT support, abusing remote access and even physical intrusion. The provider also describes espionage by China-linked groups. Confidential client information makes law firms attractive as potential routes into their clients. CrowdStrike

The same applies to client communications. A familiar sender address alone does not authenticate a new instruction or an unusual request for data. Our article on phishing from a compromised mailbox explains this breach of trust.

Three checks for your next IT meeting

The following steps are our practical recommendations based on the attack patterns. Work through them with your internal team or IT service provider.

1. Can someone approve remote support on the spot?

Walk through a real support request: receipt, identity verification, approval, session and closure. Is there a known callback channel and a named owner? A number supplied by the caller is not independent verification.

Ask to see which remote access tools are installed, who can use them and how sessions are logged. Include unattended access. Joint guidance from CISA, NSA and MS-ISAC recommends restricted privileges, account reviews and risk-based, time-limited access, among other measures. Remote access guidance

Meeting outcome: an approved tool list, a mandatory verification process and a person responsible for outstanding access issues.

2. Which client records can a compromised account reach?

Start with an ordinary user account. Which files, shared workspaces, data rooms and sharing links can it access? Include closed matters and external guests. Prioritise permissions whose misuse could expose particularly sensitive information.

Review authentication for email, remote access and administrator accounts. CISA recommends phishing-resistant multifactor authentication. An MFA prompt is not automatically equivalent to phishing-resistant sign-in. CISA recommendation

Meeting outcome: a specific permission to revoke or a protection measure with a deadline and verifiable completion. “We have MFA” does not answer the access question on its own.

3. Who decides when files or email become unavailable?

Rehearse an outage on a day with active deadlines. Who contacts the service provider? Who decides to suspend an account? How do you reach those people without your email system? What information does management need to assess client communications and further obligations?

Legal organisations have also publicly reported incidents themselves. In August 2023, the German Federal Bar reported a ransomware attack on its Brussels office and its work with an external security provider. This is an older individual case, not evidence for the current growth figures. German Federal Bar

Meeting outcome: a reachable emergency contact, a named decision-maker and a tested alternative for the most important workflow.

A review needs to result in completed work

An open remote access connection, excessive client-file permissions and an unverified emergency contact are different tasks. Each needs an owner, a deadline and evidence that the change works.

Kopexa supports this security work: connect affected information assets and assets to risks and measures. Evidence belongs to measures, which can be mapped to the relevant controls. This turns “discussed with IT” into a verifiable improvement. Technical protection remains the responsibility of your security tools and operations.

Our ISMS software page explains how to organise this work over time. Start with one concrete question: Who can approve remote access to client information today, and can you trace the last request?