Cybersecurity for Small Law Firms
Protection for firms of 1 to 9 people, built around the threats that are hitting firms like yours right now.
Your firm holds things attackers want
Your client files, trust account activity, and settlement details are valuable, and many attackers know it. You don’t need to be a big firm to be a target. Smaller firms are often easier to target because they usually don’t have someone whose job is watching for trouble.
What’s happening right now
In a May 2026 advisory, the FBI warned that a criminal group known as Silent Ransom Group (also tracked as Luna Moth) has been targeting U.S. law firms.
The tactic is simple and it works: a caller claims to be from your IT support, asks an employee to install remote-access software, and then steals data and demands payment.
The FBI has also reported attackers showing up in person, claiming they need to image a computer. Some of these attempts start with a fake charge on a subscription email that asks you to call a number to dispute it.
The lesson: an unexpected call, email, or visitor claiming to be IT is a reason to slow down, not speed up.
Four habits that close the most common gaps
1. Verify before you grant access. Nobody from outside should get remote access to your computers without a check. If someone claims to be your IT provider, hang up and call back using a number you already have on file, not one they gave you. Your office should know who your IT provider is and how they identify themselves
.
2. Verify every wire instruction by phone. If payment details change, or arrive close to a closing or disbursement, confirm them by calling a number you already know, not by replying to the email.
3. Turn on multifactor authentication everywhere that matters. That includes email and your legal software, such as practice management, document management, and billing tools. Many firms protect email and forget the other systems.
​
4. Keep backups you can actually restore. A backup that has never been tested is a guess. Keep copies off your network, and check that you can restore from them.
Six Threats:
Learn how to spot them
Business Email Compromise
-
Wire instructions change close to a closing or settlement date.
-
Someone asks you to update wire details in the middle of a deal.
-
The sender’s address is one letter off from the one you know.
Phishing /
Outside Counsel Impersonation
-
Wire instructions change close to a closing or settlement date.
-
Someone asks you to update wire details in the middle of a deal.
-
The sender’s address is one letter off from the one you know.
Ransomware
-
Files renamed or moved in bulk after hours.
-
Backups or antivirus shut off, and nobody on staff did it.
-
Data leaving your network to places you don’t recognize.
Insider Threats / Access Control
-
Former staff or of-counsel still have logins to your software.
-
No one has checked who has access since they were hired.
-
Offboarding only removes email, not your case and billing tools.
Credential Compromise
-
Logins from places you’ve never been.
-
Two logins too far apart in time to be the same person.
-
Password reset emails you never asked for.
Third-Party / Vendor Compromise
-
A vendor or opposing counsel sends files you weren’t expecting.
-
A vendor tells you they’ve seen strange activity on their side.
-
A portal login request arrives by email instead of inside the portal.