Clients now treat law firms as part of their attack surface

Law firms hold the communications, deal records, litigation strategy, and personal information their clients most need to protect. Extortion crews can reach that concentration through ordinary-looking support calls, while unmanaged AI use can create additional copies of privileged material outside agreed controls.

Clients have begun responding in kind, treating outside counsel as a security-critical supplier with evidence-based expectations for access, data handling, AI, and incident coordination.

Winning and keeping sensitive matters increasingly depends on security evidence clients can verify.

Why Law Firms Became a Top Ransomware Target

A single convincing support call can open a path to files with consequences far beyond the firm’s own network.

Law firms remain a preferred target because matter files concentrate what criminals value most. A single matter can combine client communications, litigation strategy, transaction documents, financial records, and personal information, often including facts that could move a client’s negotiating position or market value.

That concentration gives criminals leverage without encrypting a single system. A threat to publish or sell stolen data puts privilege, regulatory obligations, and negotiating positions under pressure at the same time.

BakerHostetler’s 2026 Data Security Incident Response Report, built from more than 1,250 incidents the firm handled in 2025, found ransomware attacks against law firms nearly doubled over the prior year. Across the full incident set, average initial ransom demands rose 70 percent to $4.2 million, and class actions followed 14 percent of publicly disclosed incidents, up from 9 percent in 2024.

The FBI warned in May 2025 that Silent Ransom Group, also tracked as Luna Moth, Chatty Spider, and UNC3753, had focused on U.S. law firms. Since March 2025, the FBI said, the group had shifted from callback phishing, where a deceptive message persuades a recipient to call the attacker, to direct calls impersonating firm IT staff. Attackers steered employees into remote support sessions, often under the pretext of urgent after-hours maintenance, using legitimate products including Zoho Assist, Syncro, AnyDesk, Splashtop, and Atera.

Once inside, the group searched for valuable information and exfiltrated it using WinSCP, a file-transfer client, or renamed or concealed copies of Rclone, a command-line data transfer utility. The attack surface includes the employee’s trust in an apparent IT call, the remote-access tools that follow it, and the document repositories and case-management systems behind them.

The pattern reached one of the country’s larger firms this August. Troutman Pepper Locke, an Atlanta-based firm with more than 1,600 attorneys, said an employee was targeted on August 7 by a social engineering attack using communications that appeared legitimate. The firm engaged a cybersecurity specialist and notified the FBI, and within weeks it faced a proposed class action in Atlanta federal court on behalf of roughly 37,000 people whose personal information was allegedly exposed.

The Operator’s Lens

• Budget for the client security reviews your most sensitive matters will attract, because a small breach involving deal or litigation files can put the whole relationship at risk.
• Restrict and log remote-support access on sensitive matters, with independent verification before any help-desk-initiated session proceeds.

Privileged data protection depends on enforceable boundaries for systems and people. AI adoption will test whether those boundaries remain intact when work shifts into new tools.

The AI Governance Gap Inside Firms Handling Privileged Data

Client confidence depends on knowing which AI tools can touch matter data, under what controls, and with whose review.

Generative AI use in legal work creates an exposure path for privileged matter files, deal documents, discovery material, client strategy, and personally identifiable information when lawyers or staff use consumer tools outside approved systems. The American Bar Association describes AI as a workflow and operations issue. For firms handling client data, it is also a control and professional-responsibility issue.

The critical distinction is between a controlled service with enforceable data commitments and an unmanaged prompt entered into a public or consumer product. A defensible program identifies approved tools, permitted information categories, prompt and output retention, model-training terms, processing locations, and third parties or subprocessors with access.

Policy alone does not demonstrate control. Governance has to reach the matter workflow through identity controls, matter permissions, vendor review, retention rules, and documented human review of AI-assisted work. Human review addresses flawed drafting and fabricated citations while preserving the professional judgment clients retain counsel to exercise.

Attorney-client privilege now has its first bright line. In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York ruled in February 2026 that documents a defendant generated with the consumer version of Anthropic’s Claude were protected by neither attorney-client privilege nor the work product doctrine. The ruling left open how counsel-directed use of enterprise AI platforms with stricter confidentiality terms will be treated. Engagement terms, configuration, data flow, jurisdiction, and the communication’s purpose can still affect the outcome.

Clients increasingly expect plain answers about approved platforms, model training, security protections, attorney supervision, and documentation. Assigning that responsibility across partners, information security, procurement, and practice leadership turns governance into an auditable control system.

The Operator’s Lens

• Maintain a client-ready register of approved AI tools, permitted data types, retention terms, and accountable business owners before a questionnaire forces the exercise.
• Make matter-level human review and access logging prerequisites for AI-enabled work on privileged or restricted data.

Client expectations increasingly arrive as contract terms. Outside counsel guidelines are where AI governance stops being internal policy and becomes a commitment the firm must evidence.

Get Ahead of the Outside Counsel Guidelines Your Clients Will Send

Clients are using outside counsel guidelines to turn security expectations into evidence requests, escalation paths, and approval gates.

An outside counsel guideline, or OCG, defines the security outcomes a client expects, separates mandatory obligations from optional practices, and identifies the evidence the client intends to review. Ballard Spahr has argued that OCGs can become unclear, inconsistent, and difficult to operate, and firms that engage the terms early are better placed to negotiate requirements they can actually run.

The underlying expectations date back years. The Association of Corporate Counsel published model information protection and security controls for outside counsel in 2017, covering encryption standards, breach notification windows, and subcontractor accountability, and client guidelines have grown more specific since.

Six areas show up in nearly every client guideline.

• Information boundary. Which client data the firm may hold, where it may reside, who may access it, and when it must be returned or securely deleted, across matter workspaces, document-management platforms, email, mobile devices, portable media, and home-office systems.
• Classification and access. Controls scaled to data type, from trade secrets and merger materials to regulated personal information and litigation strategy, plus multifactor authentication, encryption in transit and at rest, prompt access removal when roles change, and periodic review of matter permissions.
• Prohibited practices. Whether shared accounts, unmanaged devices, consumer file-sharing services, and forwarding to personal email are permitted anywhere in the practice.
• Technology and AI. Approved collaboration and file-transfer channels, and advance approval for any platform that stores, processes, or transmits restricted matter data.
• Subcontractors. The firm stays accountable for contract lawyers, managed review providers, e-discovery vendors, and other legal service providers working the matter.
• Incidents. Covered events including suspected unauthorized access, ransomware, lost devices, misdirected communications, and subcontractor incidents, with an initial notification window, named client contacts, updates as facts are validated, and the client’s role in forensic work, regulatory analysis, communications, and privilege.

AI clauses sit on top of duties firms already carry. ABA Formal Opinion 512, issued in July 2024, tied generative AI use to existing obligations of competence, confidentiality, and supervision, so a client’s AI terms largely ask a firm to evidence what professional conduct rules already expect.

Settle the prohibited-practices questions internally before a client asks. Annual review, a named security escalation path, and a ready evidence package then keep the agreement workable as tooling and matters change.

The Operator’s Lens

• Build one master security schedule the firm can map to every client’s OCG instead of running a different control set per engagement.
• Route new data-hosting platforms, AI services, and downstream legal service providers through written client approval so exceptions stay visible.

Law firms sit inside their clients’ information chain, often holding the data with the greatest commercial and legal consequence. Defensible protection now takes more than good questionnaire answers. It takes controls that withstand social engineering, govern AI use at the matter level, and give clients timely visibility when conditions change.