Law firms face rising cyber risk as attackers adopt AI

Law firms hold exactly the kind of information cybercriminals value: confidential client communications, financial details, legal strategies and other sensitive records. Recent reports have drawn fresh attention to attacks targeting the legal sector, including campaigns linked to social engineering and the growing use of artificial intelligence by threat actors.

AI does not create an entirely new category of cyber risk. It can, however, help attackers make familiar tactics faster and more convincing. Generative AI can improve the quality of phishing and impersonation messages, while attackers continue to exploit compromised credentials, unpatched software and weaknesses in day-to-day security processes. For law firms, the combination raises the stakes because a security incident can affect client confidentiality as well as business continuity.

Law firms are attractive targets because they hold valuable information about multiple clients, from confidential legal strategies and financial records to intellectual property and details of pending transactions. Many also handle substantial client funds, creating opportunities for payment fraud. That combination gives attackers several ways to profit: stealing sensitive data, diverting payments or using the threat of disclosure and business disruption to pressure firms into paying a ransom.

Cybersecurity is not solely an IT issue for a law firm. Attorneys, partners and support teams routinely exchange time-sensitive information and communicate with clients, courts, vendors and other outside parties. That normal flow of communication creates opportunities for social engineering, especially when a message appears urgent or comes from a familiar name.

In fact, the Acronis Cyberthreats Report H2 2025, based on Acronis Threat Research Unit (TRU) telemetry, found that phishing accounted for 83% of all email threats in the second half of 2025. It also documented attackers integrating AI into social engineering workflows. While not specific to law firms, these findings reinforce the need to verify sensitive requests rather than rely on how convincing a message appears.

The practical response is not panic, but resilience: Reduce the chance of compromise, detect suspicious activity early and be prepared to recover if an attack succeeds.

• Strengthen identity security. Require multifactor authentication for privileged accounts and critical systems, and apply least-privilege access so users have only the permissions they need.
• Train for modern social engineering. Use recurring security awareness training and phishing exercises. Include senior leaders and staff who handle sensitive data or payment requests.
• Keep systems patched. Use routine vulnerability scanning and patch management to reduce exposure to known weaknesses across endpoints and applications.
• Improve endpoint detection. Use endpoint detection and response (EDR) or extended detection and response (XDR) to help identify suspicious behavior, persistence and lateral movement.
• Protect the recovery path. Maintain multiple encrypted backup copies in separate locations, consider immutable storage, and test restores regularly so recovery procedures are proven before an incident.
• Practice incident response. Maintain and regularly test an incident response plan that identifies key contacts, communications channels and responsibilities if normal systems become unavailable.

No single control can eliminate cyber risk. A layered approach that combines identity protection, employee awareness, endpoint security, patching, backup and tested response procedures can reduce exposure and improve a firm’s ability to keep serving clients when attacks occur.