Legal Sector Intrusions Nearly Double as Criminal Groups Drive Attacks, CrowdStrike Reports

Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026, according to the CrowdStrike 2026 Legal Threat Landscape Report. Legal entities hold privileged communications, corporate transactions, intellectual property, government matters and financial records, which makes them attractive to both criminal groups and nation-state adversaries. The report covers activity observed from 1 September 2025 through 31 August 2026.

Financially motivated adversaries accounted for 82% of observed activity. They profit by deploying ransomware, or by stealing data and then using it for extortion or selling it on criminal markets. Big game hunting groups named 455 legal entities on dedicated leak sites, a 39% increase on the previous year. CrowdStrike also warns that advancing AI is likely to help attackers increase the scale and sophistication of their operations.

One group, CHATTY SPIDER, stands out. Its activity rose 129% in the first eight months of 2026 compared with all of 2024, and law firms made up nearly 90% of its victims. It almost exclusively targeted U.S.-based law firms, and that is highly likely to continue. The group tricks victims by impersonating IT staff to set up remote access sessions, then steals sensitive data within minutes, increasingly using trusted enterprise tools to do so.