When your organisation hires a law firm, sharing sensitive information is part of the process. You might send them contracts, employee records, financial documents, details of an upcoming acquisition or evidence relating to an investigation. Your lawyers need that information to do their job, and you expect them to keep it safe.
But what happens if someone hacks the law firm? According to CrowdStrike's October 2026 Legal Threat Landscape Report, cybercriminals are increasingly targeting law firms for the confidential information they hold. The report found that financially motivated attackers were responsible for 82 per cent of the malicious activity observed against the sector.
For enterprise security teams, the problem doesn't stop at the law firm's own cybersecurity. Your organisation might have excellent security controls, but once you've shared information with an external adviser, you don't get to control every system where it's stored or used. And if someone breaks into those systems, your information could be at risk too.
What Happens to Enterprise Data When a Law Firm Is Hacked?
When hackers break into a law firm's systems, what happens next depends on what they manage to access and what they do with it. A ransomware attack could lock lawyers out of documents they need for an ongoing case. Attackers might also steal confidential files and threaten to publish them unless someone pays a ransom.
Sometimes, criminals can get hold of sensitive information without disrupting the firm's day-to-day operations at all. For the law firm's clients, the consequences can go well beyond an interrupted legal service. Stolen documents might contain details of an acquisition that hasn't been announced, confidential contracts, employee information or private discussions about a legal dispute.
Depending on what's taken, that information could be used for extortion, fraud or further attacks. CrowdStrike found that 455 legal organisations were named on ransomware and extortion groups' leak sites between September 2025 and August 2026. That's a 39 per cent increase from the previous reporting period.
It doesn't tell us how many enterprise clients had their information stolen, but it does show how valuable legal-sector information has become to attackers. Of course, a law firm reporting a breach doesn't automatically mean every client's information has been exposed.
Hackers might only have reached one part of the firm's network, or investigators might still be trying to work out which documents were affected. Some files could have been viewed without being copied, while others might have been stolen. So, for the enterprise, the real question isn't just whether its lawyers have been hacked.
It's whether its own information was involved, and what could happen if it was.
Who Is Responsible for Protecting Data Held by External Lawyers?
Law firms have legal and professional duties to protect their clients' information. But that doesn't mean enterprises can hand over confidential documents and leave every security decision to their lawyers.
In England and Wales, the Solicitors Regulation Authority's confidentiality guidance for solicitors requires regulated firms to protect information about both current and former clients. Those duties continue after the relationship ends, unless disclosure is allowed or required by law, or the client agrees to it.
There's also a difference between confidentiality and legal professional privilege. Privilege can protect certain communications with lawyers from being disclosed in legal proceedings, depending on the circumstances and the law involved. It doesn't cover every document a law firm holds, and it certainly doesn't stop hackers from stealing information.
Things get a little more complicated when personal data is involved. Under UK GDPR, an organisation can be a data controller, which means it decides why and how personal information is used, or a processor, which handles that information on someone else's behalf. An external law firm might be an independent controller because it has its own professional responsibilities.
So, unlike some other suppliers, it won't necessarily have to follow every instruction its enterprise client gives it about handling personal data. This affects what the two organisations can agree on when it comes to security, breach reporting and deleting information.
The exact responsibilities depend on the relationship, the information involved and the law that applies. The enterprise still needs to decide what it shares, understand the risks and agree on suitable protections. It just can't assume that hiring a law firm gives it complete control over what happens to its information afterwards.
How Can Enterprises Protect Data Shared With Law Firms?
The best time to think about protecting information held by external lawyers is before anything goes wrong. You don't need to control the law firm's entire IT environment, but you do need to understand where your information goes and how it's being protected. The UK's National Cyber Security Centre makes a similar point in its supply chain security principles.
It recommends setting security requirements based on the risks involved, including them in supplier contracts and checking that suppliers can meet them. For enterprises working with outside lawyers, this means looking beyond the firm's reputation and thinking about what you're actually trusting it with.
Know what information your law firm holds
Before sending documents to outside counsel, work out what information the lawyers actually need. A firm reviewing a routine contract probably doesn't need the same access as one handling a confidential acquisition or regulatory investigation.
Sending entire folders because it's easier can leave your lawyers holding information that has nothing to do with the work you've asked them to do. Start by keeping track of which legal matters involve external advisers, what kinds of documents you've shared and how sensitive that information is.
It's also worth making sure someone within the enterprise is responsible for keeping those records up to date. Your legal team might know exactly what was sent, while your security team understands the risks. Both need enough information to make sensible decisions. And don't forget about older matters.
A law firm you worked with several years ago might still have copies of confidential documents, even though the original case or transaction has long since ended. If that firm gets hacked, knowing what you've shared will make it much easier to work out what could be at risk.
Assess security before sharing sensitive information
A law firm might have an excellent reputation, but that doesn't tell you much about how it protects its systems. Before handing over particularly sensitive information, find out what security measures the firm has in place. That includes things like encryption, multifactor authentication, access controls, security monitoring and how it deals with cyber incidents.
How far you go with these checks should depend on the work involved. You'd reasonably expect more detailed answers from a firm handling confidential acquisition documents than one reviewing a fairly ordinary agreement. You should also ask how documents will be shared.
A secure collaboration platform with restricted access might give you more control than sending attachments back and forth by email, especially when several people need to work on the same files. Depending on the risks, you can ask for security certifications, independent audit findings or other evidence that the firm's protections are working.
Just remember that a completed questionnaire or certification doesn't guarantee security. What you're trying to establish is whether the firm can protect the particular information you're sharing, and whether any weaknesses need attention before you send it.
Understand who else can access the data
Your law firm might not be the only organisation handling your documents. Lawyers often use cloud storage, document management platforms, e-discovery services and other specialist providers. Some also use AI tools to help with research, reviewing documents or drafting legal work.
These services can make the work easier, but they also mean your information could be handled by organisations you've never dealt with directly. For example, if a law firm uses an outside provider to review thousands of documents during litigation, you'll want to know where those documents are stored, who can access them and what happens when the review is finished.
AI tools raise similar questions.
- Can lawyers enter confidential client information into them?
- Does the provider keep that information?
- Could it be used for other purposes?
You won't necessarily need to approve every supplier the law firm uses. But you should agree on what kinds of sharing are allowed, when the firm needs to tell you about another provider and which arrangements require your approval.
You should also understand what security requirements the firm places on those providers, because your information doesn't become any less sensitive when it's passed along.
Agree on notification, retention and deletion
It's also worth agreeing on what happens when something goes wrong, or when the legal work comes to an end. The Information Commissioner's Office recommends that data sharing agreements explain what information is being shared, who's responsible for it, how it will be protected and what should happen to personal data throughout its lifecycle.
For enterprises working with law firms, this means making sure contracts and related agreements are clear about security incidents.
- Who should the firm contact if there's a breach?
- How quickly should it get in touch?
- And what information will it need to provide?
You'll also need to think about what happens to documents after the work is finished. You might want everything returned or deleted, but law firms can have legal, regulatory or professional reasons to keep certain records. They can't always delete information just because a client asks them to.
Instead, agree on what needs to be kept, for how long and how it will be protected. Where documents can be deleted, you can ask the firm to confirm that it's done so. Just bear in mind that getting confirmation isn't quite the same as being able to check that every copy has actually been removed.
What Should an Enterprise Do If Its Law Firm Is Breached?
Finding out that your lawyers have been hacked doesn't immediately tell you how serious the situation is for your organisation. You first need to find out whether your information was involved. Once you have a clearer picture, you can work out what responsibilities you have and whether there's anything else you need to do.
Establish whether your information was affected
Start by contacting the firm's security or incident response team and asking what they know about the breach. You'll want to find out which systems were affected, whether any of your legal matters were involved and what types of documents might have been accessed. It's also important to ask whether there's evidence that information was stolen or published.
You probably won't get every answer straight away. Cyber investigations take time, and what the firm knows in the first few hours could change as it finds out more. Rather than waiting for a final report, agree on how often you'll receive updates and what information your organisation needs to make its own decisions.
This is where those records of what you've shared become useful. They can help you work out what might have been affected, even while the law firm is still investigating. You'll also need to separate what's been confirmed from what's still uncertain.
Not being able to rule out data theft doesn't mean documents were definitely stolen, although it might still be sensible to take precautions.
Assess your own reporting and business obligations
If the breach may have involved personal information, you'll need to work out whether your organisation has any reporting responsibilities. The ICO's personal data breach guidance explains that organisations acting as controllers must assess the risk to the people whose information was affected.
Under UK GDPR, breaches that meet the reporting threshold generally need to be reported to the ICO within 72 hours of the controller becoming aware of them. But that doesn't mean every law-firm breach has to be reported within 72 hours, or that your organisation automatically needs to report it.
It depends on what information was involved, the role each organisation plays and which laws apply. Where the law firm is acting as a processor, it has to tell the controller about a personal data breach without undue delay. And personal information isn't the only thing to worry about.
If attackers have stolen acquisition plans, confidential contracts or litigation documents, the business could face serious consequences even if no personal data was involved. Depending on what's happened, your legal, security, privacy and communications teams may all need to be involved. Senior management might also need to make decisions about the wider business risks.
The important thing is to understand what the breach means for your organisation, rather than assuming the law firm's response will take care of everything.
Contain the exposure and review the relationship
Once you've established what might have been affected, look at whether anything needs to change on your side. If the law firm has access to your organisation's systems or shared workspaces, check those permissions. You might need to restrict access, change credentials or temporarily stop using certain collaboration tools.
If the systems you normally use to exchange documents have been affected, you'll also need another secure way to communicate and continue the work. Of course, legal matters don't always come with the luxury of waiting until an investigation is finished.
Court deadlines, transactions and regulatory requirements can still need attention, so your legal and security teams will have to agree on how essential work can continue safely. Once the immediate situation is under control, look back at how the relationship was managed.
- Did the firm tell you about the breach quickly enough?
- Did you know what information it held?
- Were you able to get the answers you needed?
Those answers should help you decide whether the existing protections are enough, whether your agreements need changing or whether it's time to reconsider the relationship.
Final Thoughts: Your Data Doesn't Stop Being Your Concern When You Share It
Sharing confidential documents with outside lawyers is a normal part of running a business. But once that information leaves your organisation, keeping it safe involves people, systems and responsibilities that you don't have complete control over. That's why a law-firm breach can become your organisation's problem, even if hackers never get anywhere near your own network.
The best preparation is knowing what you've shared, where that information might be held and what you've agreed will happen if something goes wrong. It also means thinking about what happens to those documents long after the legal work is finished. As law firms use more external platforms and providers, keeping track of client information is only going to get more complicated.
Enterprises need to make sure their approach to information governance keeps up. And with third-party relationships playing such a big role in enterprise cybersecurity, EM360Tech continues to cover the risks, responsibilities and decisions organisations face when protecting information beyond their own systems.
Comments ( 0 )