From Los Angeles Business Journal · staff-author · · 2m
Cybersecurity: Law Firms Face AI-Driven Threats
Law firms increasingly targeted by AI-powered cyberattacks, with 13% of firms breached in 2026.
In brief
Law firms increasingly targeted by AI-powered cyberattacks, with 13% of firms breached in 2026. Law firms face rising AI-driven cyberattacks, with 13% breached in 2026, requiring strict cybersecurity protocols to protect client data. Originally reported by Los Angeles Business Journal.
ShinyHunters Breach
The FBI recruitment portal was breached by ShinyHunters in late September 2026, exposing thousands of employees' sensitive information.
“The cybercriminal group ShinyHunters had breached an FBI recruitment portal”
Rising Cyberattacks
Law firms experienced a 6% to 13% increase in cyberattacks since 2025, according to the 2026 Tabush Group survey.
“the number of cyberattacks has more than doubled since 2025”
Financial Impact
Data breaches cost law firms an average of $4.99 million, with ai-driven attacks averaging $6 million each.
“the average global incident totaled $4.99 million”
Recent Breaches
Weil, Gotshal & Manges and Fox Rothchild faced data extortion incidents, leading to class action lawsuits.
“Weil, Gotshal & Manges was the victim of a sizable data extortion incident”
Buchalter Incident
Buchalter reported a breach involving Arrowhead Regional Medical Center's client data in 2026.
“Buchalter was also recently hit, reporting an incident involving their client, arrowhead regional medical center”
AI Threats
Hackers use ai to automate phishing scams and create convincing impersonations of clients and institutions.
“cybercriminals are stepping up their game in the age of ai, using the technology to automate phishing scams”
Christine Lofgren
Christine Lofgren teaches generative ai for lawyers at Southwestern Law School and warns about ai's impact on data security.
“the legal profession is entrusted with a lot of confidential information”
Christina Tusan
Christina Tusan, a former federal trade commission attorney, highlights risks of ai in financial transactions and phishing.
“wire transfer requests are particularly vulnerable”
Phishing Scams
Tusan and Lofgren report phishing scams targeting law firm staff with fake emails and qr codes.
“a law firm can have a highly secure system, but it can all be undone with a simple scan or click”
AI in Law Firms
Law firms use ai for legal research and administrative tasks, but face risks of data leaks and hallucinations.
“if an attorney inputs confidential client information into a generative ai application, the data can lose confidentiality”
Tusan's Advice
Tusan recommends verifying all financial transactions by phone and blocking phishing attempts to prevent breaches.
“most people don’t know that if the addressee and wire number don’t match, banks will often still let the wire go through”
AI Security Assessments
Blank Rome conducts security assessments before implementing ai products to ensure data safety.
“we use ai in a closed environment in which questions are processed within the firm’s own systems”
California Bar Guidance
The California State Bar requires lawyers to avoid inputting confidential client data into ai tools without informed consent.
“the duty of competence requires more than the mere detection and elimination of false or fabricated ai-generated results”
Diane Cafferata
Diane Cafferata emphasizes the need for lawyers to understand ai tools' limitations to prevent breaches.
“lawyers and law firms remain responsible for complying with those duties”
AI as Junior Colleague
Lofgren advises lawyers to view ai as a junior colleague requiring supervision for accurate legal research.
“a lawyer who already understands the relevant law may be able to use ai to quickly identify cases”
Next Steps
Law firms must implement strict ai security protocols to protect client data and prevent breaches.
“it is very important for everyone to block and report any phishing attempts or unsolicited calls”
The big picture
Law firms face rising AI-driven cyberattacks, with 13% breached in 2026, requiring strict cybersecurity protocols to protect client data.
