Cyberattacks Against Law Firms and Professional Service Firms

Obtaining sensitive and highly valuable information and documents—that is the goal of most cyberattacks against law firms and professional service firms

A few days ago, it was reported that one of the Big Four—that is, one of the world’s four largest professional service firms—suffered a security incident involving an attack on its ticketing system, which is used by its IT support staff to provide support to the entire organization. During the incident, the attackers were able to download documents containing personal and financial information about the firm’s clients that was used to prepare their tax returns.

This incident is not an isolated case and demonstrates that:

1. Cyberattacks against law firms and professional service firms are on the rise and are not limited to large companies. Small and medium-sized law firms are also in the crosshairs.
2. Third-party software—such as the ticketing platform used by the company—must be factored into a company’s security strategy, since many incidents originate from attacks on vendor software.
3. Law firms and professional service firms handle particularly sensitive data and information about individuals and businesses, making them a particularly attractive target for cybercriminals.

Next, we will provide an overview of cyberattacks against law firms and professional services firms and explain how cybersecurity services for law firms and professional services firms are critical to optimizing the security posture of organizations that are essential to the economy.

Law firms are a target for malicious actors because they handle highly valuable information and their cyber exposure is on the rise

In mid-February 2026, a cybercriminal was sentenced to 8 years in prison for unlawfully accessing the systems of several firms specializing in tax services, collecting information from their clients, and using it to file 1,000 fraudulent tax returns, through which he managed to collect $1.3 million in tax refunds.

This case highlights a key issue regarding cyberattacks against professional service firms: they handle highly valuable confidential information.

Thus, unlike other sectors, the professional services sector deals with particularly sensitive data and documents. We’re not just talking about personal information, but also financial data on companies and individuals, accounting and tax documents, legal strategies in ongoing litigation or pre-trial negotiations, confidential contracts, patent documents, medical information…

Added to this is the fact that the professional services sector has become fully digitized in recent years. The use of legal, tax, or accounting management software and AI tools to automate and streamline processes is widespread, which increases the level of cyber exposure for companies that handle confidential information across multiple software platforms.

This scenario implies that:

• Cyberattacks against law firms and other professional service firms can be particularly lucrative for malicious actors, given the value of the information they can obtain.
• Firms need to develop a cybersecurity strategy that focuses not only on the protection of confidential data and documents related to their clients, but also on their business continuity. This is because if an incident forces them to work offline, their operations can be severely impacted.

Lawyers, consultants, advisors… Professionals with a high level of digital visibility

Not only have companies seen their cyber exposure increase, but their own professionals also have an ever-growing digital visibility.

These days, it’s hard to do a Google or Bing search for a lawyer or consultant and not find information about them. In fact, you’ll most likely be able to find out where they work easily, what position they hold within their organization, and even who their clients are through news reports or social media posts.

What does this mean? It means that malicious actors can successfully conduct reconnaissance on their potential victims and design highly personalized social engineering attacks to deceive their victims and gain access to their organizations’ software and systems.

This issue is of enormous importance because the two entry vectors for cyberattacks against law firms and professional service firms are:

• Their own staff: professionals, executives… For example, in June 2026, the FBI warned of a campaign targeting U.S. law firms, in which malicious actors posed as members of the organizations’ IT teams to gain access to their corporate devices, establish a persistent presence on them, steal highly valuable information, and extort them.
• Vulnerabilities in the software they use.

Most Common Types of Cyberattacks Against Law Firms and Professional Service Firms

Based on the overview we have just outlined, we can summarize the main types of cyberattacks against law firms and professional service firms:

• Phishing attacks and other social engineering techniques that use emails, phone calls, or messages via professional social media platforms to trick employees into revealing their login credentials for corporate software or allowing malicious actors to take control of their devices. Along with the impersonation of IT teams—which has been used to successfully attack firms such as Lewis Brisbois Bisgaard & Smith, with annual revenues exceeding €700 million—we can highlight other tactics such as deepfakes of clients or senior managers using generative AI, or the impersonation of Human Resources teams posting fake job offers.
• Brute-force attacks to crack passwords for accessing corporate systems. These cyberattacks against law firms are successful if passwords are weak and multi-factor authentication systems are not in place.
• Ransomware. Installing this type of malware allows malicious actors to encrypt a firm’s data and demand a ransom in exchange for not selling it to the firm’s or its clients’ competitors or leaking it publicly. Ransomware attacks pose a twofold threat to firms: they disrupt operations and also open the door to serious data breaches.
• Other malware. Malicious actors can also use other malicious programs, such as spyware, which allow them to spy on their victims while attempting to persist for as long as possible and escalate privileges to gain access to a larger volume of information.

Insiders: Not all cyberattacks against law firms and other firms originate from outside

In the previous section, we left out one of the types of cyberattacks against law firms and other firms that can cause the most damage to an organization: internal security threats.

As we have noted, lawyers, consultants, and advisors have access to both corporate software and critical information about their clients and the processes or projects in which they are involved.

This opens the door for dissatisfied or corrupt professionals and former employees who retain active access credentials to:

• Deploy malware on corporate systems: ransomware, spyware, etc.
• Steal data and documents of great importance to sell them to third parties.
• Exfiltrate information about customers to damage the company’s reputation and cause legal problems.
• Delete data from business systems, thereby undermining the delivery of professional services.

How can internal security threats be prevented? Organizations can:

• Develop security policies to prohibit actions such as storing confidential documents on personal devices like USB drives or sending files to personal email accounts.
• Establish a security permissions system to limit who can access each client’s data and documents, ensuring that no user has more permissions than are strictly necessary to perform their job.
• Implement internal mechanisms to audit the actions carried out by professionals and detect anomalous behavior that may indicate data exfiltration or deletion.
• Immediately revoke all access to corporate systems and software for employees when they leave an organization.

The Dangerous Consequences of Cyberattacks Against Law Firms and Professional Service Firms

Preventing cyberattacks against law firms and professional service firms must be a strategic priority for organizations. This is because the consequences of a security incident can be enormous:

• Disruption to the organization’s operations. The deletion of data and documents from corporate software or the need to go offline to contain a very serious security incident can affect a firm’s operations and undermine its business continuity, with all that this entails in terms of financial impact and brand image.
• Reputational damage. Indeed, cyberattacks against law firms and professional service firms can cause severe reputational damage, especially if confidential client documents and information are compromised. For companies in the professional services sector, client trust is a critical asset. If a company’s or an individual’s data is stolen and/or leaked, the organization will not only lose that client but also risks many other clients ceasing to use its services.
• Penalties and Legal Disputes. Lawyers have a very strict duty of confidentiality toward their clients, and data protection regulations are becoming increasingly stringent. If cyberattacks against law firms and professional service firms result in unauthorized access to sensitive information such as judicial, tax, or medical data, organizations face substantial fines and legal disputes that can cause serious damage to their reputation and finances. For example, it was reported a few days ago that the U.S. firm WilmerHale is facing a class-action lawsuit over a personal data breach.
• Financial Losses. All the consequences of cyberattacks against law firms and professional service firms that we have listed have one thing in common: they result in financial damage to the organizations. To this, we must add the investment that companies must make to respond to an incident and return to normal operations successfully.

How to Protect Against Cyberattacks on Law Firms and Successfully Manage Incidents

Given the potential consequences of cyberattacks on law firms and professional service firms, it is vitally important that organizations treat cybersecurity as a strategic priority, have a strategy in place to optimize their security posture, and invest in key cybersecurity services such as:

• Continuous and automated monitoring of the technology infrastructure to detect suspicious behavior, combining the use of advanced solutions with the expertise of professionals capable of filtering out false positives and identifying suspicious activity as quickly as possible.
• Security audits. These are essential for detecting vulnerabilities in an organization’s digital assets, including third-party software.
• Vulnerability management. Detecting and prioritizing the remediation of weaknesses affecting corporate software and systems is critical to preventing cyberattacks against law firms and professional service firms.
• Social engineering tests. Given the growing complexity and sophistication of social engineering techniques, firms must conduct social engineering tests to verify whether their professionals can resist these techniques and to train them in the most cutting-edge TTPs in the professional services sector.
• Penetration testing. Through advanced penetration testing, experts simulate real attacks in controlled environments to identify vulnerabilities that malicious actors could exploit to achieve objectives such as gaining access to and stealing sensitive data and documents related to a law firm’s or professional services firm’s clients.
• Proactive Incident Response. To limit the impact of cyberattacks against law firms and professional services firms, it is essential to have a proactive incident response service that can be activated the moment an attack is detected to determine the scope of the breach, contain the incident, expel the malicious actor, and implement the disaster recovery plan as soon as possible to restore the company’s full operational capacity.

In short, law firms and professional service firms need to arm themselves against malicious actors who seek the valuable information in their possession to maximize the financial gain from their criminal activities.