By Josh Neame, CTO, BlueFort Security
When it comes to data protection and cybersecurity, law firms face a particular set of risks. Like other organisations, they must protect personal information under regulations like GDPR. But they also handle highly confidential client material, including communications and documents that may be protected by legal professional privilege.
The consequences of a breach can therefore extend well beyond the exposure of personal data. Confidential legal advice, litigation strategy, commercially sensitive negotiations, and information about major corporate transactions can all be valuable to an attacker. If that information falls into the wrong hands the damage can affect clients, ongoing cases, commercial deals, and a firm’s reputation.
At the same time, law firms are dealing with many of the same changes affecting IT and security teams across other sectors. Applications and data are moving beyond the traditional network perimeter, cloud platforms have become central to day-to-day work, and the growing availability of AI tools is creating further questions about how sensitive information is accessed, shared, and protected.
It’s easy to see why law firms are attractive targets. An attacker might be looking for intelligence on a specific deal or case, seeking to extort a firm by threatening to expose confidential documents, or simply exploiting an opportunity to steal data for financial gain. Others may be motivated by activism, or (cue the gravelly delivery of Michael Caine) simply to watch the world burn. Whatever the motive, law firms hold information that can have significant financial, commercial, and personal value.
The Consequences are Already Visible
Recent incidents demonstrate that these risks are far from theoretical.
In the US, law firm Greenberg Traurig faces proposed class action lawsuits following a cyber breach involving sensitive personal information. Another US firm, GrayRobinson, disclosed a breach involving the personal information of more than 65,000 people. Both incidents show that the information held by a law firm can extend well beyond the immediate details of a legal matter, with consequences that continue long after the initial compromise.
The UK has seen the consequences of a major incident, too. The 2025 cyber attack on the Legal Aid Agency resulted in the exfiltration of a significant volume of personal data. An October 2026 government update provided further detail on the information affected, including records relating to legal aid applicants, providers, and some probation service users.
When Social Engineering Becomes a Business Process
Technology vulnerabilities and poorly configured systems remain important risks. However, attackers do not always need to exploit a technical weakness when they can persuade someone to give them access.
This is particularly relevant in legal environments, where people routinely work under pressure, deal with urgent requests, and handle sensitive documents as part of their daily responsibilities. A convincing phone call from someone claiming to be IT support can be enough to compromise confidential information. In September, Seyfarth Shaw disclosed a breach where an employee was deceived by someone impersonating the firm’s IT help desk and emailed client documents to an unauthorised account. Equally, an attack might use a plausible request connected to a live matter to exploit the trust that underpins everyday legal work.
A recent report from Google Threat Intelligence Group and Mandiant, Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms, describes a financially motivated data theft and extortion campaign observed between January and May 2026. The activity was attributed to UNC3753, also known as Silent Ransom Group, Luna Moth, and Chatty Spider.
The group uses voice phishing (vishing) and other social engineering techniques to gain remote access to victims’ environments. Attackers may pose as IT support, use pretexts involving invoices or data migration, and persuade employees to participate in screen-sharing sessions or install remote monitoring tools.
The FBI has also issued a specific warning about Silent Ransom Group targeting law firms. More recently, a Check Point Threat Intelligence Report found the group is taking a sophisticated commercial approach to targeting firms. The researchers uncovered “a process-driven operation” and described the group’s structured approach to managing extortion, treating victim engagement and negotiation as parts of an organised operation.
Check Point’s analysis of leaked material from the group also points to possible efforts to extend social engineering into physical or employment-based access. The researchers describe this as seeking to “industrialize human-enabled access”, treating social engineering as a “coordinated production process”.
What stands out to me is the level of preparation. These are not generic phishing attempts sent in bulk and left to chance. The attackers invest in their pretexts, prepare for conversations, and work to make their requests appear credible.
That puts individual lawyers and other frontline staff in a difficult position. They need to recognise suspicious behaviour, follow security procedures, and protect confidential information. Yet they also need to respond to clients, meet deadlines, and keep cases moving. The more convincing and targeted the deception, the harder it becomes to rely on awareness alone.
Training matters, but placing too much emphasis on it puts too much weight on individual judgement, particularly when the technology gives attackers an easy way in. Security teams also need to give people the tools to work efficiently while reducing the chances that one mistaken decision will expose sensitive information.
Helping Lawyers Work Securely, Without Getting in the Way
As legal work increasingly spans cloud applications, remote access, and AI services, protecting a fixed network perimeter is no longer enough. Security needs to account for who is accessing information, which application they are using, where data is going, and what that data contains.
Secure Access Service Edge (SASE) brings together network and security capabilities through a cloud-delivered approach. For law firms, this can help apply consistent protection as users access services from different locations, rather than relying solely on controls tied to the office network. Capabilities such as Zero Trust Network Access (ZTNA), secure web gateways and cloud access security controls can help govern access to applications and reduce exposure to risky destinations.
Data loss prevention (DLP) adds another important layer. Access controls can help determine who is allowed to use a service, but they do not necessarily determine whether a particular document, client record, or piece of confidential information should be shared through it. DLP can inspect data in motion and apply policies to help prevent sensitive information from being transferred to inappropriate destinations.
This becomes particularly important as firms consider how staff should use generative AI. AI tools can help lawyers research, summarise, and draft, but pasting confidential client information into an unapproved service can introduce risks that are difficult to reverse. Simply blocking every AI platform may restrict legitimate work, while allowing unrestricted use leaves too much to individual judgement. Visibility into how AI tools are being used, clear policies and controls that can identify sensitive data provide a more practical way to manage that balance.
Firms still need clear governance, effective training, appropriate access controls, and well-understood processes for handling confidential information. When attackers deliberately exploit the pressure and trust built into everyday working practices, firms cannot rely on asking staff to be more careful. They need security controls that help reduce the risk in the first place.
Join BlueFort’s Webinar with Legal IT Insider
I’ll be discussing these challenges and what law firms can do to address them in an upcoming webinar with Legal IT Insider and iboss on Thursday 22nd October at 3pm.
I’ll be joined by Caroline Hill, editor-in-chief at Legal IT Insider, and Simon Eappariello, SVP, EMEA & APJ at iboss. We’ll explore the evolving threats facing law firms, and how modern security approaches can help protect confidential information while allowing legal professionals to work effectively.
Register for the webinar
Can’t attend live? Register to receive the recording afterwards.
