A major law firm can spend millions of dollars securing its technology and still have a cybersecurity incident begin with something remarkably simple: A believable conversation. That appears to be one of the recurring themes behind a wave of cybersecurity incidents affecting law firms.

In August 2026, Troutman Pepper Locke, one of the largest law firms in the United States, disclosed a data breach after an employee was reportedly targeted through social engineering. According to reporting from The Atlanta Journal-Constitution, the firm said the employee interacted with communications that appeared legitimate but were not. The firm subsequently engaged a cybersecurity specialist and notified the FBI. A proposed class-action lawsuit followed. The allegations in that litigation remain allegations at this time.

Law.com reported in September 2026 that at least 10 large law firms had confirmed data breaches between Memorial Day and Labor Day, with multiple incidents reportedly involving social engineering. The trend reveals something important about modern cybersecurity. Attackers do not always need to defeat your technology. Sometimes they only need to convince someone inside your organization to trust them.

Law Firms Are Valuable Cybersecurity Targets

To understand why law firms are being targeted, it helps to consider the information they possess. A law firm may simultaneously hold confidential communications, intellectual property, merger and acquisition information, financial records, personally identifiable information, employment data, medical information, litigation strategies, settlement information, corporate investigations, regulatory materials, and credentials providing access to additional systems. In other words, a law firm's data environment can become a concentrated repository of extraordinarily sensitive information belonging not only to the firm, but also to its clients. That fundamentally changes the cybersecurity risk.

Stolen information may potentially support extortion. Confidential documents may contain commercially valuable information. Personally identifiable information can facilitate fraud or identity theft. Compromised email accounts may be used for additional social engineering. Information about transactions, disputes, or payments could potentially make business-email-compromise attempts much more convincing. Cybercriminals increasingly understand something businesses sometimes overlook: The value of your organization is not the only thing attackers evaluate. They also evaluate the value of the information entrusted to you.

The FBI's warning regarding Silent Ransom Group illustrates how far these tactics can go. The bureau reported that members of the group have used IT-themed social engineering calls and, in some scenarios, arranged for a person posing as IT support to physically enter an organization and connect a storage device to a computer. That is not simply phishing. It is an attack against an organization's entire trust process.

Identity Is Becoming Part of the Security Perimeter

For decades, organizations built cybersecurity strategies around a physical or network perimeter. Systems inside the network were trusted. Systems outside were not. Today, identity itself has become one of the most important cybersecurity boundaries. A person with legitimate credentials can potentially move through systems in ways that traditional perimeter defenses cannot automatically distinguish from normal activity. That makes identity security extremely important. Organizations should evaluate not only whether employees use multifactor authentication, but also what happens after authentication succeeds.

Which applications can that person access? How much data can they retrieve? Can they download thousands of files? Can they create new administrator accounts? Can they disable security tools? Can they access client environments? Could a compromised account move laterally into another system? Effective cybersecurity assumes that credentials can eventually be compromised. The goal should therefore be to limit what an attacker can accomplish even after obtaining access.

Law Firms Face a Unique Problem After a Breach

For organizations entrusted with confidential information, the consequences of a cyber incident do not end when the attacker is removed from the network. The next question becomes: What information was accessed? That question can be extraordinarily difficult to answer. A law firm may possess years of documents involving thousands of individuals. Determining whether files were merely accessible or actually obtained may require extensive forensic investigation. Organizations may then need to determine which clients are affected, which regulatory requirements apply, whether individuals require notification, whether contractual obligations were triggered, and whether litigation is likely.

The above incident demonstrates how quickly cybersecurity and legal exposure can become intertwined. Following the reported August 7 incident, a proposed class action was filed alleging that approximately 37,000 people faced increased risks of fraud and identity theft. The existence of a lawsuit does not establish that the allegations are true or that the firm was legally at fault. But it illustrates something every business should understand: A cybersecurity incident can become a legal, financial, operational, and reputational event almost immediately.

Incident Response Cannot Begin After the Incident

Organizations frequently spend far more time thinking about preventing breaches than preparing to respond to them.Both are necessary. An effective incident-response plan should answer difficult questions before leadership is forced to answer them during an emergency. Who has authority to isolate systems? Who contacts outside cybersecurity professionals? Who engages legal counsel? How will executives communicate if company email is unavailable? How are logs preserved?

Who communicates with clients? When does the cyber insurance carrier need to be contacted? Who determines whether regulators or law enforcement should be notified? Which vendors need to participate? Where are backups stored? How does the organization determine whether those backups are trustworthy? The middle of a breach is a bad time to discover that nobody owns these decisions. Tabletop exercises can be particularly valuable because they force leadership teams to simulate an incident before one occurs. 

The Real Goal Is Cyber Resilience

Organizations sometimes pursue an impossible objective: Prevent every attack. No security program can guarantee that an organization will never experience a cybersecurity incident. A more realistic objective is resilience. Can the organization make attacks difficult? Can suspicious behavior be identified quickly? Can access be contained? Can attackers move freely between systems? Can critical operations continue? Can systems be restored? Can leadership determine what happened? Can affected stakeholders be identified? Can the organization communicate accurately? Can lessons from the incident strengthen future defenses?

That is cyber resilience. Security is not simply about whether someone gets through the front door. It is about what happens next.

How Cryptek Helps Organizations Identify Risk Before an Incident

At Cryptek Cybersecurity Services, we help organizations understand cybersecurity risk before attackers expose it for them. Our work includes vulnerability scanning and reporting, vulnerability assessments, penetration testing, compliance risk assessments, cloud and network security, data protection and encryption, endpoint security, managed security services, disaster recovery planning, digital forensics, and cybersecurity training. For law firms and other professional-services organizations, cybersecurity requires understanding both the technical environment and the human environment surrounding it. The objective is not simply to deploy more security tools. It is to understand where trust exists, where access exists, where sensitive information lives, and where an attacker could exploit the connections between them.

Cryptek Cybersecurity Services helps businesses identify vulnerabilities, evaluate cybersecurity controls, and strengthen their defenses before an incident occurs. To discuss your organization's cybersecurity posture, call (414) 206-5099 or email info@cryptek.tech.