Hacking Risks for Law Firms in 2026: How Firms Actually Get Breached — and How to Protect Yours

Law firms are not breached because attackers are brilliant. They are breached because a firm holds concentrated, high-leverage information behind controls that were designed for a ten-person office and never revisited.

Five-minute takeaway: In 2026 the dominant hacking risks for law firms are (1) credential theft and session-token hijacking against Microsoft 365, (2) business email compromise aimed at settlement, escrow, and closing wires, (3) ransomware and data-theft extortion delivered through unpatched internet-facing systems and remote access, (4) broken access control in client portals and intake forms, and (5) third-party compromise through co-counsel, e-discovery vendors, and court-adjacent services. The controls that stop most of it are unglamorous: phishing-resistant MFA, conditional access, out-of-band wire verification, patching what faces the internet, and testing the portal. A firm should verify all of this with independent external testing at least annually, and continuously if it handles M&A, IP, healthcare, or financial-services matters.

Why attackers target law firms disproportionately

A firm is a data aggregator without the security budget of the organizations whose data it aggregates.

Concentration. A single corporate practice may hold pre-announcement merger terms, board minutes, and patent applications for dozens of companies. Attacking one firm is cheaper than attacking twenty clients, and the firm is almost always the softer target.

Leverage. Confidentiality is not just a compliance obligation for a firm — it is the product. That makes extortion unusually effective. An attacker who exfiltrates matter files does not need to encrypt anything to be paid; the threat of publication is enough.

Money in motion. Settlement funds, real estate escrow, and closing wires move through firm-controlled accounts on predictable timelines that are visible inside a compromised mailbox.

Trust relationships. A message from a law firm's real domain gets opened by opposing counsel, clients, courts, and title companies. A compromised firm mailbox is a launch pad.

Fragmented IT. Most firms under 200 attorneys run a mix of a managed IT provider, a practice-management SaaS, a marketing agency with website access, and partner-owned devices. Nobody owns the whole attack surface.

The seven attack paths that actually work in 2026

1. Credential theft and token replay against Microsoft 365

Password-only accounts are largely gone. What replaced them is worse in one specific way: attackers now target the *session*, not the password. Adversary-in-the-middle phishing kits proxy the real Microsoft login page, capture the authenticated session cookie after the user completes SMS or app-approval MFA, and replay it. From the firm's logs it looks like a successful, MFA-satisfied login.

Once inside a mailbox, the pattern is consistent: create an inbox rule that files messages containing "wire," "invoice," "settlement," or "closing" into a rarely-read folder; register an additional MFA method for persistence; read for two to six weeks; then act.

What closes it: phishing-resistant MFA (FIDO2 security keys or passkeys, or Windows Hello for Business) for every attorney and every account with billing or admin access; conditional access policies restricting sign-in by device compliance and geography; alerting on new inbox-forwarding rules and new MFA-method registration; token-lifetime limits and continuous access evaluation.

2. Business email compromise and wire fraud

This is the loss event that most reliably produces a malpractice claim. The attacker sits in a mailbox, learns the transaction, and sends payment instructions at the exact moment the client expects them — from the real thread, in the partner's writing style, with a plausible explanation for the account change.

Personal injury firms lose settlement disbursements. Real estate practices lose closing funds. Estate planning practices lose trust distributions. The funds are gone within hours through layered accounts.

What closes it: a written, non-waivable callback rule — every payment instruction and every change to instructions is verified by phone to a number obtained from the file *before* the request arrived, never a number in the email; dual authorization for outbound wires above a defined threshold; banner tagging on all external mail; and a client-facing disclosure at engagement stating the firm will never change wire instructions by email.

3. Ransomware and data-theft extortion

Encryption is now optional. The reliable revenue for the attacker is exfiltration plus a publication deadline, because a firm cannot restore its way out of a confidentiality breach.

Entry points, in rough order of frequency: unpatched internet-facing appliances (VPN concentrators, remote-access gateways, file-transfer applications), remote desktop exposed to the internet, and credential reuse against a service without MFA.

What closes it: know every internet-facing asset you own and patch edge appliances on an emergency schedule, not a quarterly one; eliminate direct RDP exposure; offline or immutable backups tested by actual restore drills; egress monitoring for bulk data movement; and network segmentation so a document management server is not reachable from a receptionist's workstation.

4. Client portals and intake forms with broken access control

The most common serious finding in law firm web applications is not injection — it is authorization. A portal that returns a document when you change a numeric ID in the URL. An intake system whose "download my file" endpoint never checks that the file belongs to the requesting user. A password-reset flow that leaks whether an email is a client of the firm.

These are invisible to the network scanners a managed IT provider runs, and invisible to the firm until someone else finds them. See web application penetration testing for law firms for how this testing is scoped.

What closes it: authenticated, multi-role application testing of the portal and intake stack at least annually and after any change to authentication or file handling.

5. Third parties, co-counsel, and vendors

Your confidentiality obligation follows the data. E-discovery platforms, transcription services, cloud practice management, outside copy centers, expert witnesses, translators, local counsel, and marketing agencies with CMS credentials all hold or can reach client material.

What closes it: a vendor inventory that records what data each vendor touches; contractual security and breach-notification terms; evidence of independent testing from any vendor holding matter data; and removal of standing access for former vendors, which is the step nearly everyone skips.

6. Insiders, departing attorneys, and stalkerware

Family law and employment practices face a threat model most security vendors ignore: a motivated individual with physical or relationship access to a client's device or account. Departing associates who copy matter files to personal cloud storage are the routine version.

What closes it: least-privilege access by matter rather than firm-wide file share access, offboarding checklists that revoke SaaS and mobile access the same day, alerting on bulk downloads, and a client-safety protocol in domestic matters for compromised devices.

7. AI tools and shadow IT

By 2026, most firms have attorneys using general-purpose AI assistants. The risk is not the technology; it is configuration and ungoverned use — consumer-tier accounts that train on input, browser extensions with document access, and transcription bots silently joining privileged calls.

What closes it: an approved-tools list, enterprise tiers with contractual no-training terms, a written firm AI policy, and client-consent guidance. See AI tools and attorney-client privilege.

What a breach actually costs a law firm

The direct incident bill is rarely the largest number.

Ranges reflect commonly cited market figures and vary widely by firm size, data volume, and jurisdiction. Treat them as planning estimates, not quotes.

The uncosted items matter more: client attrition after disclosure, outside counsel guideline disqualification from panel work, cyber insurance renewal at higher premium with tighter conditions, and the professional-responsibility question of whether the firm's safeguards were reasonable under ABA Model Rule 1.6(c) and its competence counterpart, Rule 1.1 Comment 8.

The obligations that turn risk into a duty

• ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of client information; Formal Opinion 477R and Formal Opinion 483 address secure communication and post-breach duties to notify affected clients.
• The FTC Safeguards Rule reaches firms performing activities financial in nature — tax controversy, certain real estate and lending work, debt collection — and requires a written program, a qualified individual, and periodic testing.
• State law: New York's 23 NYCRR 500 for firms serving covered entities, and all-state breach notification statutes with clocks that begin at discovery.
• HIPAA business associate obligations for firms handling PHI in personal injury, medical malpractice, and healthcare regulatory work.
• Client contracts: outside counsel guidelines increasingly require evidence of annual third-party testing, MFA, encryption, and breach notice within 24-72 hours.

Full detail: what cybersecurity the ABA requires and whether the FTC Safeguards Rule applies to law firms.

A prioritized 90-day risk-reduction plan

Days 1-14 — stop the two loss events that hurt most. Turn on phishing-resistant MFA for partners, billing, and administrators. Publish the wire-verification callback rule and require signed acknowledgement. Enable alerting for new inbox rules and new MFA registrations. Inventory every internet-facing system the firm owns, including sites a marketing vendor stood up.

Days 15-45 — find what you cannot see. Run an external attack-surface assessment and an authenticated test of the client portal and intake stack. Check for credentials from firm domains in known breach corpora. Identify lookalike domains registered against your firm name.

Days 46-90 — make it durable. Adopt or refresh a written information security program covering access control, encryption, retention, vendor management, and incident response. Run a tabletop exercise with the managing partner, IT, and breach counsel in the room. Deliver legal-pretext phishing simulation and role-based training. Set the recurring testing schedule and document it — the documentation is what insurers and clients ask for.

How often should a firm test?

• External attack surface: continuously, or at minimum quarterly. It changes without anyone deciding to change it.
• Penetration test of the internet-facing environment: annually, and after any material infrastructure change.
• Web application test of the portal and intake: annually, and after any change to authentication, file upload, or permissions.
• Phishing simulation: quarterly, with role-based follow-up training.
• Tabletop exercise: annually, with a written after-action report.

More detail on cadence: how often to run a vulnerability assessment.

Frequently asked questions

Q: Are law firms really targeted more than other businesses? A: Yes, relative to their size. Firms concentrate the confidential data of many clients, control transaction funds, and generally operate with smaller security programs than the corporate clients they serve. That combination makes them an efficient target rather than an incidental one.

Q: What is the single most common way a law firm gets hacked? A: Credential and session compromise of a Microsoft 365 mailbox through phishing, followed by business email compromise. It requires no malware, evades SMS and push-based MFA, and monetizes directly through fraudulent payment instructions.

Q: Does cyber insurance cover wire fraud losses? A: Not automatically. Funds-transfer fraud and social engineering coverage are frequently sublimited or separate endorsements, and carriers may deny claims where documented verification procedures were not followed. Review the specific policy with your broker before assuming coverage.

Q: Our managed IT provider handles security. Isn't that enough? A: An IT provider is a necessary operational partner, but it cannot independently audit its own configuration, and its scanning tools do not find application-layer authorization flaws. Insurers and outside counsel guidelines increasingly ask specifically for independent third-party testing evidence. See Attorney Armor vs. managed IT providers.

Q: How fast must we notify clients after a breach? A: ABA Formal Opinion 483 requires notifying affected current clients when material client confidential information is compromised. State statutes and client contracts add their own clocks, some as short as 24-72 hours from discovery. Start the clock at discovery, not at conclusion of the investigation. See the first 72 hours of a law firm data breach.

Q: What should a small firm do first if the budget is limited? A: Phishing-resistant MFA, a written wire-verification callback rule, patching internet-facing systems, and one external assessment to find what is actually exposed. Those four steps eliminate the majority of realistic loss scenarios for a small practice.

Where Attorney Armor fits

Attorney Armor was built for this threat model specifically. Relevant services:

• Penetration Testing — external, web application, and client-portal testing with reporting mapped to ABA and Safeguards language.
• Vulnerability Assessment — continuous attack-surface discovery with findings ranked by exploitability and matter sensitivity.
• Continuous Monitoring — asset, credential-exposure, and lookalike-domain monitoring with instant alerts.
• Security Awareness Training — legal-pretext phishing simulation with completion evidence.
• Compliance & Insurance Evidence — WISP authoring, framework mapping, and questionnaire evidence packs.
• Incident Response — IR planning, tabletops, and containment support.

Start with the free non-intrusive external assessment on the home page — it returns your firm's externally visible exposure in about six minutes, with no agent to install and no disruption to the practice.