In the wake of the Salesforce/Gainsight breach (kudos to Salesforce for transparently sharing indicators of compromise and updated progress on remediation), third-party cyber and exposure risk is top of mind for many CISOs. Professional services firms are often overlooked in this context, with disastrous consequences.

Law firms, specifically, are particularly vulnerable to creating downstream risk impacts given the nature and purpose of legal services, and adversary targeting is on the rise.

The Industrial Consolidation of Legal Sector Attacks

The numbers paint a stark reality. Twenty % of US law firms were targeted by cyberattacks in the past year, with 56% of breached firms losing sensitive client information. The average breach cost reached $5.08 million, representing a 10% year-over-year increase that excludes long-term reputational damage and client defection.

RansomHub has emerged as 2025’s dominant threat after absorbing talent from disrupted groups like LockBit and ALPHV/BlackCat. By offering affiliates a 90/10 profit split versus the standard 70/30, they’ve attracted the most capable operators in the underground economy. Qilin’s Rust-based ransomware has specifically targeted legal entities with encryption-resistant payloads, making recovery nearly impossible.

The chart below, derived from Recorded Future analyst notes tracking ransomware extortion sites, illustrates the growth in ransomware targeting by industry, with legal firms remaining the number one target.

These aren’t opportunistic attacks. Threat actors now maintain “dwell times” exceeding weeks inside firm networks, systematically identifying crown jewel intelligence before triggering extortion events. Industrialization means attackers understand exactly what creates maximum leverage: M&A intelligence during active deals, litigation strategies before trial, and decades of retained client data across multiple matters.

Recorded Future telemetry from the past quarter indicates that over 20 observed legal or legally adjacent firms have malware communicating with malicious command-and-control (C2) servers. While the observed traffic was 24 hours or less for some firms, other organizations saw persistence above 5 days. Certainly, a malicious implant does not equate to a full breach and exfiltration of client-sensitive data; however, it is a valuable signal to monitor for changes in third-party and fourth-party risk.

Infographic depicting recent malware dwell times in global legal firm victims

When Privilege Becomes Your Adversary’s Weapon

Courts have systematically eroded attorney-client privilege protection for breach investigations, creating a dangerous trap where forensic reports become ammunition for adversaries. The Capital One decision ordered production of Mandiant’s forensic report because the investigator served “business purposes” rather than pure legal advice.

The cascade accelerates through “sword and shield” waiver doctrine. Any use of breach investigation findings, even citing them in discovery responses, can trigger a subject matter waiver, requiring disclosure of all privileged communications related to threat assessment and remediation strategy. The 2024 Samsung Data Breach ruling made this explicit: sharing reports with 15 executives indicated business decision-making use, defeating privilege.

Federal Rule of Evidence 502 creates additional exposure when companies share incident reports with regulators. The 2023 Covington & Burling case saw the SEC subpoena the firm for names of 298 publicly-traded clients whose data “may have been exfiltrated,” though a court eventually ruled that only seven clients had to be named, it did establish that law firms cannot completely shield client identity from regulators, and those clients could then face SEC investigation for failure to disclose their counsel was breached.

M&A Intelligence Monetization at Scale

When Berkeley Research Group was hit by ransomware in March 2025 during a $700 million leveraged buyout by TowerBrook Capital Partners, the attack exposed M&A intelligence across hundreds of concurrent deals. This wasn’t just data theft; it was a systematic opportunity for market manipulation.

Academic research quantifies the damage. The Intralinks/Cass Business School study found 8-10% of M&A deals leak annually, with leaked deals achieving 47% median premiums versus 27% for non-leaked deals, which is a 20 percentage point difference worth millions per transaction. Only 49% of leaked deals complete versus 72% of non-leaked deals.

The Tyler Loudon case (2024) demonstrated the benefits of access when the defendant stole M&A information from his attorney wife, resulting in insider trading charges.

The Systematic Failure to Assess Professional Services Risk

Only 30% of law firms report clients asking them to complete security questionnaires (not that attestations are a wholly competent method for determining exposure risk), compared to a near-universal requirement for SaaS vendors. This exemption culture may stem from relationship bias and the misconception that “they’re not a tech vendor” despite law firms operating technology-intensive businesses.

The data concentration goes untracked. A single firm may hold M&A details, employee PII, trade secrets, litigation strategies, regulatory issues, and executive compensation across multiple business units that operate independently. The Orrick breach (2023) exposed 637,000+ individuals precisely because the firm aggregated data from employment litigation, mergers and acquisitions (M&A) transactions, and patent filings.

Retention amnesia compounds the risk. Lawyers traditionally “keep everything forever” due to a risk-averse culture, and potential regulatory requirements. Data from cases in the 1990s may still exist on unpatched legacy servers. Each year of retention adds cumulative breach exposure, yet enterprises rarely ask law firms about deletion policies or data locations.

Strategic Actions for Enterprise Defense

Treating professional services firms as high-risk technology vendors requires structural changes to vendor management frameworks.

• Eliminate standing exemptions: Subject law and consulting firms to the same security requirements as SaaS vendors, including SOC 2 verification, independent audits, and quarterly assessments, without granting relationship-based waivers.
• Map concentration risk: Identify all professional services vendors with data access across business units. Calculate total organizational exposure when single firms hold aggregated intelligence across HR, legal, finance, and compliance matters.
• Audit fourth-party dependencies: Require disclosure of critical vendors, including MSPs, cloud providers, SaaS vendors, and document management systems. A breach of fourth-party infrastructure becomes your breach through the use of API tokens, credential harvesting, and VPN pivoting.
• Establish time-bound access: Implement purpose-limited credentials that expire at the conclusion of a matter. Eliminate long-lived access that persists in engagement reports and consulting code repositories.
• Define retention requirements: Specify data deletion periods in contracts with confirmation requirements. Audit compliance quarterly, as many firms retain data indefinitely on legacy systems.
• Deploy breach detection: Place honeytokens in systems accessible to professional services firms. Establish 24-48 hour notification SLAs with emergency credential rotation capabilities.
• Create specialized incident response protocols: Develop playbooks specifically for law firm breaches addressing privilege complications, litigation exposure assessment, and regulatory notification requirements.
• Use threat intelligence to map services firms’ domain and IP space. Use the infrastructure map to monitor and alert on observed traffic between malware implants and command-and-control (C2) infrastructure. Recorded Future's Third-Party Intelligence automates this monitoring across your entire vendor ecosystem, providing real-time alerts when professional services firms show compromise indicators. Combined with Ransomware Mitigation capabilities, organizations can track ransomware group TTPs, monitor extortion sites, and receive early warnings when vendors appear on leak sites. Immediately notify affected service providers, disable organizational access, and assist in remediation.

Wrap-Up

The evidence from 2025 makes the stakes undeniable. With 21 law firm breaches in just the first five months of 2024 and incidents like Williams & Connolly’s nation-state compromise and Berkeley Research Group’s ransomware during active M&A, the pattern is clear.

When your law firm holding decades of critical data gets breached, you don’t have a vendor incident. You have a strategic intelligence compromise with multi-year competitive implications that traditional third-party risk frameworks didn’t adequately contemplate, as they exempt “trusted advisors” from the security scrutiny their data concentration demands. The shift from relationship-based trust to risk-based verification isn’t optional; it’s survival.

Learn how Recorded Future's Ransomware Mitigation and Third-Party Intelligence solutions work together to protect against cascading vendor risk. From tracking ransomware groups targeting legal firms to monitoring your vendors for real-time compromise indicators, you can detect and respond to vendor compromises before they cascade into your organization.