Cyberattacks on Law Firms Double Amid New Billing Exploits
New data shows hackers are specifically targeting sensitive firm software as incidents have doubled since 2023.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust that professional service firms are adequately protecting your sensitive personal data from hackers?
Cyberattacks on legal entities have doubled since 2023, according to a new report from CrowdStrike covering the year ending in August 2026. The findings highlight the first instance of attackers specifically targeting law firm timekeeping and billing software.
Why it matters
Law firms have become primary targets for state-backed actors and cybercriminals because they serve as gateways to sensitive corporate intellectual property, merger details, and financial records. The recent shift toward targeting billing infrastructure underscores a new, highly specific focus on sensitive operational systems.
CrowdStrike identified 455 unique legal entities exposed on hack-leak websites through August 2026, marking a 39% rise compared to the prior year. The firm confirmed that attackers are now exploiting specific vulnerabilities within legal industry timekeeping and billing software.
The players
CrowdStrike
An Austin-based cybersecurity firm specializing in endpoint protection, threat intelligence, and cloud-workload security.
The details
Threat actors are increasingly employing agentic AI—autonomous software that can plan and execute tasks without human oversight—to scale social engineering campaigns against law firms. In one November 2025 incident, attackers hired a Russian national to pose as an internal IT employee to gain network access. These groups manipulate staff into granting unauthorized credentials to access secure systems containing privileged intellectual property.
Timeline
2023: Baseline year for the recorded doubling of cyberattacks.
November 2025: Hackers successfully deployed a human IT impersonator at a law firm.
August 2026: End of the data collection period for the CrowdStrike report.
October 28, 2026: Official release of the CrowdStrike Legal Threat Landscape Report.
The Tech Race
This report highlights a widening gap between traditional law firm defense protocols and the rapid adoption of agentic AI by malicious actors. As firms modernize their billing and internal infrastructure, they create new, automated attack surfaces that are now the primary focus of intelligence-gathering campaigns.
Legal professionals should anticipate heightened scrutiny of billing and timekeeping credentials, as these systems are now explicitly targeted. Firms will likely face increased pressure to implement multi-factor authentication and stricter identity verification processes for all IT support requests.
The takeaway
The surge in attacks signals that the legal sector is now a high-value target for strategic intelligence collection, with China-linked groups expected to remain a primary threat. Industry stakeholders should monitor upcoming threat intelligence updates to see if specific software vendors issue patches for the reported billing vulnerabilities.
Further reading
For broader trends in enterprise defense, visit the Cybersecurity section.
Live Poll
Do you trust that professional service firms are adequately protecting your sensitive personal data from hackers?
