How should underwriters assess law firm ransomware risk?

For insurers, ransomware attacks on law firms are more than a legal-sector concern. They can generate cyber insurance claims, expose firms to professional liability allegations, and disrupt the external counsel insurers rely on to handle sensitive claims and litigation.

For underwriters, brokers, and claims teams, the question is not simply whether a firm can prevent an attack, but whether it can protect confidential information, maintain critical services, and recover quickly when defenses fail. The resilience measures outlined below offer a practical lens for assessing that risk and helping policyholders limit the consequences of a breach.

It shouldn’t come as a surprise that ransomware attacks on law firms rose 54% in 2025, the second-fastest increase of any sector, and with an average ransom demand of $610,000. While law firms can attempt to protect everything, they may still fall short. The right approach is to build a resilience framework that ensures quick recovery. The focus should be on building stronger backups and incident response plans to negate the impact of even successful cyberattacks.

Law Firms in the Crosshairs

Law firms manage merger plans, litigation strategy, client finances, and confidential evidence. This information and more along the same lines passes through their systems every day. This makes them a valuable target. Another reason threat actors love this sector is that its cyber defenses are not as sophisticated as, say, the banking sector. Small wonder that 42% of firms are doubtful of recovering from a cyber setback. While firms have begun adopting cloud platforms and generative AI tools, their resilience footprint often falls short of the risk profile of that adoption.

It’s not just big firms that are targets. Smaller firms assume wrongly that they are too minor to fall into the crosshairs of attackers. But that is wishful thinking. As larger firms invest in stronger defenses, attackers increasingly turn to low-hanging fruit. A small firm may not even be the initial target but rather a shortcut to the large corporate clients it serves.

The Threat Often Overlooked

It’s natural to think of cyberattacks as stolen data or encrypted systems. But the real risk is quieter and happens under the radar.

• While firms are confident in the belief that they are safe, attackers might already be patiently sitting undetected in their network for months. They can silently manipulate data. This is essentially more dangerous than stolen information, as law firms rely on data to build cases, advise clients, and close deals.
• Serious attackers use sophisticated techniques that enable them to sit inside a network for the long run, allowing ample time to study how the firm operates, the chain of command, identifying key stakeholders, and learning which projects have the most valuable data. This knowledge makes them even more dangerous.
• Long-term surveillance helps them pick the right candidates (partners and senior executives) to create deepfakes. These stealthy video and audio impersonations are convincing because attackers have studied how partners communicate.
• A partner or intern may believe sharing a photo or sending a casual voice message on an unsecured channel isn’t a very serious lapse in judgment. But this lapse can return to bite them, as attackers can learn about a target’s routine, contacts, and behavior by piecing together such information.
• Reputation is everything in the legal industry. A deepfake or leaked confidential material involving a senior partner can cause lasting damage.

From Protecting Data to Managing Risk

Attackers have to be successful just once, while defenders have to get it right every single time. The scales are not tipped in their favor. An ideal resilience framework therefore should include a layer of active defense and risk management.

In practice, resilient firms:

• Assume they are being watched, and their valuable data is under threat at all times. This means employees must be trained to think before clicking and ensure communication happens only through approved, secure channels.
• Plan how they will recover from a successful breach. Prepare a response, rehearse it, and think from the perspective of limiting the blast radius as much as possible.
• Identify the firm’s crown jewels and control access to them. Know how these jewels are protected, who can reach them, and restrict access to those who absolutely require it.
• Weigh the security implications of newly introduced AI platforms and the necessary governance that must attend these risky adoptions. Deployment and governance should go hand in hand.
• Ensure the security fund is ample and can grow in line with the threat landscape. Avoid a situation where security spend is sacrificed for other spend.

The Real Defense is Culture

Tools and technology matter, but so does an embedded security best-practice culture. Durable resilience is supported by a culture where people don’t click on just any link, think judiciously about the company information they are sharing online, and treat such information as vulnerable. The firms that best survive will accept the risk, prepare for recovery, protect their reputation as carefully as their data, and consider risk management the cornerstone of everyday business.