The 2026 law firm ransomware wave: why legal became a top target

How many law firms have been hit by ransomware in 2025 and 2026?

The most concrete public count comes from Halcyon, whose March 11, 2026 alert tracked more than 200 ransomware incidents against the Law Firms and Legal Services sector across 2025 and early 2026 ^[1]. That figure covers tracked incidents only, so it represents a floor rather than a ceiling; victims who pay quietly or never appear on leak sites are not captured. Even as a floor, 200-plus incidents in a little over a year marks legal services as one of the most heavily pressured professional sectors, and the trend line runs through early 2026 rather than tapering off.

The tempo is as telling as the total. INC Ransom claimed 10 law firms in a single 48-hour window and roughly 20 firms in 2026 year-to-date ^[1]. Notably, Halcyon found no confirmed supply-chain vector behind the surge ^[1]. That absence matters: these firms were not swept up through one compromised vendor or a shared software flaw. Each intrusion appears to have been earned individually, which points to a repeatable playbook aimed at the sector itself. When attackers invest in firm-by-firm targeting at that pace, the campaign is deliberate, not opportunistic.

It helps to sit with what a two-day, ten-firm burst implies about the machinery behind it. A single 48-hour window that produces ten claimed victims is not the signature of a lone operator improvising against targets of convenience. It is the signature of a process that has been rehearsed, with reconnaissance, access, and data theft each reduced to steps that can be run in parallel across multiple firms at once. The pace is the tell. Campaigns that move that quickly have usually already solved the hard problems of getting in, and are now optimizing throughput. For a firm reading these numbers, the practical lesson is that the interval between a peer being hit and yourself being probed can be short, and the window for tightening defenses is not open-ended.

Why "tracked incidents only" is the most honest number available

It is worth being precise about what the 200-plus figure measures, because the caveat is not a footnote, it is the key to reading the whole wave correctly. Halcyon's count reflects incidents that surfaced through observable attacker behavior, primarily claims on leak sites and public extortion pressure ^[1]. That methodology systematically undercounts in one direction only. A firm that pays quietly before its name is posted, a matter resolved through a private negotiation, or an intrusion that never escalates to a public listing all fall outside the tally. There is no comparable force pushing the number upward, because attackers gain nothing by fabricating victims they never touched.

The consequence is that the true incident count is very likely higher than 200, and the honest way to use the figure is as a directional floor rather than a precise total. This is the opposite of how breach numbers are often marketed, where a single point estimate gets repeated as if it were audited. Treating the Halcyon figure as directional threat intelligence keeps the analysis defensible: it supports the conclusion that legal is under sustained, concentrated pressure without overstating certainty the data cannot carry. For firm leadership deciding how seriously to weight this wave, an undercounted floor of 200-plus is arguably more alarming than a precise total would be, because it means the observed pressure is the visible portion of something larger.

Directional does not mean soft. A count that can only understate the problem still establishes a lower bound, and a lower bound of 200-plus sector incidents is a strong signal on its own.

Which groups are targeting legal, and why now

Two names dominate the current wave. INC Ransom is running what Halcyon describes as a rapid campaign against law firms, with the 48-hour, 10-firm burst as its signature statistic ^[1]. The Silent Ransom Group, meanwhile, has distinguished itself with a data-theft focus that extends beyond the network entirely, including physical entry into offices ^[2]. Both operate as extortion businesses first: the objective is leverage over the victim, and tactics are chosen for whatever most reliably produces files a firm cannot afford to see published.

Why legal, and why now? A law firm concentrates the crown-jewel information of every client it serves: deal terms, litigation strategy, trade secrets, and personal records, all in one environment. Compromising a single firm can yield leverage over dozens or hundreds of organizations at once, without attacking any of them directly. Add the profession's duty of confidentiality, which raises the reputational cost of a leak far above that of a typical corporate breach, and the sector offers extortionists an unusually favorable ratio of pressure generated per intrusion. The 2025 and 2026 numbers suggest attackers have internalized that math.

The two groups also illustrate that the wave is not a single technique but a family of them. INC Ransom's contribution is pace, a demonstration that firms can be worked through in rapid succession ^[1]. The Silent Ransom Group's contribution is method, a willingness to reach the data through whatever channel is least defended, including the physical one ^[2]. What unites them is a shared read of the target. Neither group appears to be treating law firms as generic corporate networks that happen to be reachable. Both are treating the confidentiality obligation itself as the pressure point, which is why the sector is being pursued as a category rather than as a series of unrelated opportunities.

The in-person intrusion tactic that changes the threat model

The Silent Ransom Group has used in-person physical intrusion against U.S. law firms, with operators entering offices to steal data directly, according to Halcyon and corroborating reporting from Dark Reading ^[2][3]. This is not social engineering over the phone; it is a person walking into a workplace. For a threat category most firms file under IT, the reappearance of physical tradecraft is a significant shift, and it deliberately routes around the detection tooling that firms have spent the past decade deploying at the network and endpoint layers.

Physical intrusion invalidates the quiet assumption behind most security programs: that the attacker is remote. Email filtering, endpoint detection, and VPN hardening do nothing about someone standing at an unattended workstation. Countering it pulls facilities and operations into the ransomware conversation, because the controls that matter now include things no security appliance touches:

• Visitor management and badge discipline become security controls, not office etiquette.
• Screen locks, clean-desk habits, and physical file storage matter again.
• Reception logs and after-hours access records become part of the incident evidence.

Why physical entry is a governance problem, not just a facilities one

The reappearance of physical tradecraft does not add a new tool to the security stack. It redraws the boundary of the stack, pulling facilities, reception, and after-hours access inside the same conversation as endpoints and email.

It is tempting to file the in-person tactic under office logistics: lock the doors, check the badges, done. That framing understates the shift. When the attack surface includes the reception area and the unattended desk, the boundary of the security program stops being the network perimeter and starts being the building itself, and the people responsible for the building are usually not the people responsible for security ^[2][3]. A firm that has invested heavily in endpoint detection can still be walked past by an operator who never touches the network in a way that endpoint tooling would notice. The two categories, digital and physical, were historically owned by different teams, and the Silent Ransom Group's method exploits exactly that seam.

Closing the seam is a governance question before it is a hardware question. Someone has to own the decision that visitor logs are now security evidence, that after-hours access is a monitored event, and that a workstation left unlocked in a shared space is a reportable exposure rather than a minor lapse. None of that requires exotic technology, but all of it requires a firm to decide, deliberately, that the physical environment is inside the security boundary. The uncomfortable part is that these controls depend on habit and enforcement rather than on a product you can buy and forget. Reception discipline erodes quietly, which is precisely why an attacker willing to show up in person finds it worth the effort ^[2].

Why extortion economics make privileged files the highest-value loot

Most stolen data depreciates. Payment cards get reissued, passwords get rotated, and personal records lose freshness. Legal data is the exception, because confidentiality is permanent: privilege and trade secrets never expire, so a stolen file retains its leverage for as long as the underlying matter is sensitive ^[3]. A settlement strategy, a patent draft, or an estate file can damage a client decades after the breach itself. That permanence is what makes privileged files the highest-value loot in the extortion economy; the threat of disclosure never ages out, and the attacker knows it.

Look at the exchange from the attacker's side and the targeting logic becomes obvious. In most sectors, stolen data is a depreciating asset, and an extortionist has to convert it to payment quickly before it loses value. Legal files invert that clock. Because the sensitivity does not decay, the leverage does not decay either, and the attacker can afford to be patient, to negotiate hard, and to hold material in reserve. A firm cannot wait out the threat the way a retailer can wait out a batch of stale card numbers. That asymmetry, permanent value on the attacker's side against a permanent obligation on the firm's side, is the economic engine underneath the 200-plus incidents, and it is why the sector keeps drawing repeat attention rather than a single passing wave ^[1][3].

The same permanence creates a quantum-era problem known as harvest now, decrypt later. Encrypted data stolen today can be stored cheaply and decrypted in a future era when quantum computers can break the public-key cryptography that protected it. For most industries that risk is bounded, because the data will be stale before decryption becomes feasible. For legal files that must stay confidential indefinitely, it is not bounded at all. Long-lived client files, IP portfolios, and matter archives are exactly the category where post-quantum protection stops being theoretical and becomes a straightforward duty-of-care question.

Harvest now, decrypt later: reading the risk without overstating it

Harvest now, decrypt later deserves careful language, because it is easy to describe it in a way that is either alarmist or dismissive, and neither is accurate. The concrete claim is narrow and defensible: an attacker who steals encrypted data today can store it cheaply and attempt to decrypt it later, if and when the cryptography protecting it becomes breakable ^[3]. It is an anticipatory risk, not a present-day decryption event. Nobody is claiming that today's stolen archives are being read today. The point is that the decision to hold the data has already been made in the attacker's favor, because storage is nearly free and the potential payoff, for the right file, does not expire.

What makes legal the sharp case is duration, not drama. For a sector whose data goes stale in months, the harvest-now calculus rarely pays off, because the window closes before decryption becomes feasible. For files that must stay confidential for decades, the window never closes. That is the entire argument, and it does not depend on predicting when large-scale quantum decryption arrives or on any specific timeline. The honest posture here is to call post-quantum protection quantum-safe rather than quantum-proof: it raises the cost and forward-secures long-lived data against the anticipated threat, without pretending to be an unbreakable guarantee. For long-retention legal archives, that shift from bounded risk to unbounded risk is enough to make the question a matter of ordinary diligence rather than speculation.

Anticipatory, not active. Harvest now, decrypt later is a reason to forward-secure long-lived data today, not a claim that stolen files are being decrypted now.

What a tamper-evident evidence trail adds after a breach

After a ransomware incident, a firm faces a second crisis that gets less attention than the encryption: every internal record is now suspect. An intruder who obtained administrator access could have edited or deleted logs, so the systems that would normally answer what happened and what was touched can no longer vouch for themselves. Clients, regulators, and insurers will each ask for proof, not assertions. A firm that can only answer with records the attacker could have altered is negotiating its credibility at exactly the moment credibility is worth the most.

This is where a tamper-evident evidence trail earns its place: records that are hash-chained, signed with post-quantum cryptography, and sealed to an external transparency log stay verifiable even after the environment they came from is compromised. RankShield Legal provides that record layer. It does not prevent ransomware, and it does not replace endpoint defense or incident response. What it adds is the ability to demonstrate, with independently checkable evidence:

• What the firm's systems recorded before, during, and after the intrusion.
• Which records provably survived with their integrity intact.
• A trail that clients, regulators, and insurers can verify without taking the firm's word for it.

Where an evidence layer fits, and where it does not

Precision about scope matters here, because the wrong expectation is worse than none. An evidence layer is not a defense against the intrusion itself. It does not stop INC Ransom's pace, it does not detect the Silent Ransom Group's operator at the reception desk, and it does not encrypt the endpoints or maintain the backups that a firm still needs to run ^[1][2]. Anyone who positions a verifiable record layer as a substitute for endpoint defense, email filtering, physical controls, or professional incident response is describing a product that does not exist. RankShield Legal is explicitly the layer that assumes those defenses can fail and answers the question that comes after, not instead.

The distinction is easiest to see across the timeline of an incident. Prevention lives before the breach, in the controls that keep an attacker out. Response lives during and immediately after, in the work of containment and recovery. Verifiable evidence lives in a third position, spanning the whole timeline but proving its value only once trust in the firm's own systems has been shaken, because that is the moment when records an attacker could have altered stop being persuasive. The table below places the categories side by side, so the boundaries stay clear rather than blurring into a single vague promise of security.

A measured response sequence for firms facing this wave

The numbers argue for action, but not for panic, and the two are easy to confuse. A firm reading a 200-plus incident floor and a two-day burst of ten claimed victims can reasonably conclude that legal is a concentrated target, without concluding that a specific rushed purchase will solve it ^[1]. The more durable response is sequenced: understand the specific ways this wave reaches firms, close the seams those methods exploit, and make sure that if an intrusion does land, the firm can prove what happened. The steps below follow that order deliberately, moving from the physical and organizational realities the current groups exploit toward the evidentiary posture that matters after the fact.

1. Treat the physical office as part of the attack surfaceThe in-person tactic means visitor management, badge discipline, screen locks, and after-hours access logs are security controls now, not office housekeeping. Decide, at the governance level, that the building is inside the security boundary ^[2][3].
2. Keep the core defenses that this layer never replacesEndpoint detection, email filtering, tested backups, and a retained incident-response capability remain the foundation. An evidence layer assumes these can fail; it does not stand in for them.
3. Forward-secure long-lived confidential dataBecause privilege and trade secrets do not expire, long-retention files sit squarely in the harvest-now, decrypt-later category. Post-quantum protection is quantum-safe rather than quantum-proof, and for decades-long archives that shift is a duty-of-care question, not speculation ^[3].
4. Make the record of events independently verifiableSeal system records to a tamper-evident, hash-chained, post-quantum-signed log so that after an intrusion the firm can show clients, regulators, and insurers what happened, using evidence an administrator-level attacker could not have quietly rewritten.