Cyber-Sicherheit: Report: Cyberkriminelle nehmen Rechtssektor ins Visier

Cybercriminals and state-sponsored espionage groups are increasingly targeting law firms and legal departments, with attacks on legal organizations nearly doubling compared to 2023, according to the "Legal Threat Landscape Report 2026" from CrowdStrike. The attackers primarily seek confidential client data, including merger and acquisition plans, intellectual property, financial information, and court strategies, which are ideal for financial extortion or economic espionage.

Germany, along with the USA, UK, Canada, Australia, and Israel, is among the most frequently attacked countries in the world. The majority of attacks, 82 percent, are financially motivated by cybercriminals seeking lucrative targets. Specialized extortion groups called "Big Game Hunting" targeted 455 legal organizations with data leaks, a 39 percent increase compared to the previous year.

Aggressive threat groups like "Chatty Spider" have seen a 129 percent increase in their attacks. This group exclusively targets law firms and uses deceptive methods, such as impersonating internal IT staff to trick lawyers into providing remote access software. In one documented case, hackers attempted to retrieve sensitive data just four minutes after infiltrating a system. In the USA, attackers even hired individuals to gain physical access to law firm offices to connect directly to workstations.

Around 18 percent of registered attacks are likely state-sponsored, with Chinese-linked groups comprising the majority of these espionage activities, which have nearly doubled since 2023. Chinese espionage groups increasingly use law firms as digital gateways to infiltrate networks of large corporations, government organizations, or technology firms.

Security experts emphasize that law firms are no longer mere targets but often serve as stepping stones for hackers to breach the networks of major corporations, government agencies, or technology companies. Law firms should prioritize enhancing multi-factor authentication, strictly controlling remote access programs, and consistently securing specialized industry software.