By the time they graduate law school, lawyers are often well-versed in one of the tenants of attorney ethical responsibility: keeping their clients’ information confidential. However, many attorneys fail to recognize one of the most important aspects of meeting their duty of confidentiality – cybersecurity.

Cybersecurity risks are a rising threat to law firms. Due to the nature of the information housed in law firms like privileged communications, business information, intellectual property, government information, financial records, and other sensitive information, law firms are a rich target for cybersecurity threats.

Recently, CrowdStrike (a cybersecurity company that provides endpoint security, threat intelligence, and cyberattack response services) published their 2026 Legal Threat Landscape Report.[1] According this this report, cyber intrusions by eCrime and nation-state actors targeting legal entities in 2026 have nearly doubled since 2023.[2]  

eCrime accounted for 82% of all malicious cyber activity targeting legal entities.[3] The primary actor responsible for these targeted attacks is CHATTY SPIDER, also known as Silent Ransom Group, cybercriminal group who almost exclusively targets U.S.-based law firms.[4] Not only is CHATTY SPIDER focused on law firm targets, but the rate of attacks are also on the rise. According to CrowdStrike, CHATTY SPIDER’s malicious activity increased 129% in the first eight months of 2026.[5]

CHATTY SPIDER is known for their callback phishing emails, in which they present themselves as well-known businesses offering subscription plans for a small subscription fee. To cancel the fake subscription, victims are told to call, then victims are sent an email that downloads remote access software, in turn allowing access to their device or system. Once access is established, CHATTY SPIDER actors identify valuable information to exfiltrate, then send a ransom note stating that failure to pay will result in the sharing of the victim’s data. CHATTY SPIDER is known to impersonate IT staff to persuade attorneys to establish remote support sessions via legitimate monitoring and management tools, and they consistently target victims whose contact details are publicly available on firm websites.[6] When remote access attempts fail, CHATTY SPIDER is known to orchestrate a physical intrusion into the victim’s office to plug a storage device directly into the victim’s computer. One such physical intrusion was documented in November 2025, when an individual hired by CHATTY SPIDER posed as an internal IT employee, entered a law firm, and installed remote access tools and attempted to move data to cloud storage.[7]

In addition to threats like CHATTY SPIDER, in April 2026 we saw the first observed targeting of a legal-specific software in an attack against Intapp Server, a software used for timekeeping and billing.[8] Additionally, during a 30-day period, CrowdStrike reported that one U.S. law firm experienced nearly 500 distinct failed login attempts from approximately 300 distinct IP addresses.[9] According to the 2024 ABA Tech Report, 31.8% of respondents answered that their firm had experienced a security breach, while 20.1% responded that they did not know if their firm had experienced a security breach.[10]

These ever-growing threats highlight the need for attorneys to be proactive in their approach to cybersecurity. The FBI has provided a list of recommendations for attorneys to protect themselves from CHATTY SPIDER or similar attacks. They suggest ensuring basic cyber hygiene like being suspicious, using robust passwords, and the installation of antivirus tools.[11] Additionally, the FBI suggests:

1. Verifying the credentials of all individuals accessing firm spaces
2. Conducting staff training on resisting phishing attempts
3. Developing and communicating polices surrounding when and how IT will authenticate themselves with employees
4. Maintaining regular backups of company data
5. Implementing two-factor authentication for all employees[12]

The Association of Legal Administrators have also provided a list of best practices for law firms to meet cybersecurity obligations:  

1. Develop a robust cybersecurity policy
2. Implement encryption and multi-factor authentication
3. Regularly train employees
4. Monitor and respond to threats in real time
5. Evaluate and vet third-party vendors
6. Maintain regular software updates[13]

---

[1] CrowdStrike, 2026 Legal Threat Landscape Report (2026), https://www.crowdstrike.com/en-us/resources/reports/2026-legal-threat-landscape-report/.

[2] Id.

[3] Id.

[4] Fed. Bureau of Investigation, Silent Ransom Group Targeting Law Firms (May 23, 2025), https://www.fbi.gov/file-repository/cyber-alerts/silent-ransom-group-targeting-law-firms-052325.pdf.

[5] CrowdStrike, supra note 1.

[6] CrowdStrike, supra note 1.

[7] Ana-Marie Stanciuc, Hackers Hired a Man to Walk into a US Law Firm, CrowdStrike Says, The Next Wed (Oct. 28, 2026), https://thenextweb.com/news/crowdstrike-attacks-on-law-firms-chatty-spider-intapp.

[8] CrowdStrike, supra note 1.

[9] CrowdStrike, supra note 1.

[10] Am. Bar Ass’n, 2024 Legal Technology Survey Report (2024), https://www.americanbar.org/groups/law_practice/resources/legal-technology-resource-center/tech-survey/.

[11] Fed. Bureau of Investigation, supra note 4.

[12] Id.

[13] Michel Sahyoun, Best Practices for Law Firms to Meet Cybersecurity Obligations, Legal Mgmt. (Apr. 28, 2025), https://www.alanet.org/legal-management/lm-extras/best-practices-for-law-firms-to-meet-cybersecurity-obligations.