Legal Sector Cyber Statistics: Sourced Figures on Law Firm Attacks and Readiness

Law firms hold privileged client data and move client money, yet good legal sector cyber statistics are scarce, and many of the figures quoted online cannot be traced to a survey or regulator. This page gathers the legal sector figures that can be traced to a primary publisher: the Verizon 2026 Data Breach Investigations Report (DBIR) Professional services snapshot, the American Bar Association (ABA) Legal Technology Survey cybersecurity findings, the Solicitors Regulation Authority (SRA) cyber security thematic review and its client loss figures, the LexisNexis 2025 survey of UK lawyers and the Proton 2025 survey of US legal professionals. Each figure carries its publisher, survey and year, and the age of each source is stated because legal sector data is published less often than for other sectors. It is written for law firm IT and security leads, COLPs and risk partners, in-house legal teams and insurers. For the controls themselves, read the Cybersecurity for Legal Firms Guide; this page covers only the numbers. Last reviewed: November 2026.

Key takeaways

• About one firm in four or five reports an attack or breach. The ABA 2022 survey found 27% of respondents said their firm had experienced a security breach, and Proton's 2025 survey of 500 US legal professionals found about 20% reported a cyberattack in the past year.
• Many lawyers do not know if they have been breached. In the ABA 2022 survey 25% did not know, rising to 50% at firms of more than 100 lawyers, which means self-reported breach rates are a floor.
• Payment diversion is the classic legal loss. The SRA found 30 of 40 firms it visited had been targeted directly, with more than GBP 4 million of client money stolen, and email modification fraud the most common attack.
• Professional services breaches are financially driven and credential heavy. The Verizon 2026 DBIR Professional snapshot shows a financial motive in 96% of breaches and credentials compromised in 31%.
• Readiness is patchy. Only 42% of ABA 2022 respondents had an incident response plan (9% of solo practitioners), and in the LexisNexis 2025 survey 52% of UK legal professionals always use MFA for sensitive systems.

Headline statistics

Statistics by theme

How often firms are attacked or breached

• US, 2025: Proton's survey of 500 US legal professionals, published 1 July 2025, found about 20% reported a cyberattack in the past year, and 39% of those attacked lost data or had it exposed, roughly 8% of all respondents. It is a single vendor survey of individuals, not firms.
• US, ABA: the 2022 ABA Legal Technology Survey Report found 27% of respondents said their firm had experienced a security breach, a slight increase on the previous year, 48% said it had not and 25% did not know. The ABA notes a security breach is not necessarily a data breach. Check for a newer ABA TechReport edition before quoting these figures.
• UK, SRA: the SRA's thematic review, published 2 September 2020 and based on visits to 40 firms in England and Wales during 2019, found 30 had been targeted directly by cybercriminals and in the other 10 cases criminals had targeted clients during a transaction.
• Proxy data: the Verizon 2026 DBIR does not publish a legal-only snapshot. Law firms sit in Professional services (NAICS 54) with accountants, consultants and engineers, which recorded 3,578 incidents and 2,558 confirmed breaches in the October 2024 to November 2025 dataset.

The "do not know" problem by firm size

• Reading the table: in larger firms individual lawyers are less likely to know about incidents handled centrally, so "do not know" rises with size. In small firms the respondent is often the person who would know. Breach rates from lawyer surveys therefore undercount incidents at large firms.
• Planning gap: fewer than one in ten solo practitioners and about a quarter of small firms had an incident response plan in 2022, while 72% of firms over 100 lawyers did.

Payment diversion and client money

• The trend: SRA figures presented at its 2022 compliance officer conference show reported client losses falling from about GBP 10 million in 2017 to under GBP 1 million in the first ten months of 2022, with conveyancing firms most affected. Reported losses are only those firms tell the SRA about.
• Ransomware is under-reported: the SRA review found seven significant incidents that had not been reported to it, five of them ransomware, and one firm lost about GBP 150,000 of billable time to a ransomware attack.
• Wider fraud context: payment diversion is a form of business email compromise. See the Business Email Compromise and Fraud Statistics Guide for cross-sector figures.

Breach patterns in Professional services

• Source: Verizon 2026 DBIR executive summary, covering more than 22,000 confirmed breaches in 145 countries. Across all industries the same report finds ransomware in 48% of breaches, third-party involvement in 48% and the human element in 62%; Verizon does not publish Professional-only figures for those measures in its summary.
• What it suggests for law firms: internal data (matter files, deal documents, correspondence) and credentials lead the data types, which fits both extortion and the use of stolen mailbox access for payment diversion.

Readiness, MFA and AI use

• MFA: the LexisNexis survey of more than 700 UK lawyers and legal professionals, run in July 2025, found 52% always use multi-factor authentication for sensitive systems and 36% sometimes do; among in-house leaders 59% always do.
• Threat perception: 43% named cyber security as one of their team's three most pressing challenges for the next 12 months, 38% ranked phishing and social engineering as the top threat (44% of small firm leaders) and 24% named AI-generated attacks such as deepfakes or convincing fake emails (LexisNexis 2025).
• Obligations and recovery: in Proton's 2025 survey fewer than 35% of US legal professionals were familiar with their legal obligations for handling a cyberattack, 42% were uncertain they could recover, 45% were unclear on response steps and 28.6% did not use mobile device management on company devices.
• AI governance: LexisNexis 2025 found 61% use AI for work, but only 24% said their organisation had provided appropriate training for safe AI use and 28% had an AI policy that is easy to follow (45% in large law firms). See the AI Agents in Legal Work Guide.

What the numbers mean for defenders

• Small versus large firms: a sole practitioner or small firm gets most from enforced MFA on email, a bank-detail call-back rule for every transaction, offline backups of the practice management system and a one-page incident plan with the insurer's hotline. A large firm also needs central visibility so incidents are known firm-wide, matter-level access controls, third-party risk reviews of e-discovery and practice management providers, and an exercised plan that protects privilege. See the Legal Privilege in Incident Response Guide.
• Where identity fits: payment diversion usually runs through a compromised mailbox, and credentials are the second most common data type in Professional breaches. Service accounts and API keys for document management, e-billing and e-signature integrations deserve the same care as lawyer accounts. See the Law Firm Identity and Data Security Guide.

How to turn these statistics into a programme:

1. Baseline your own numbers: MFA coverage across all accounts, the share of transactions where bank details were verified by call-back, mailbox rule alerts in the last quarter and the date of the last tested restore.
2. Stop payment diversion first: adopt a written rule that bank details are never changed by email, publish it to clients in engagement letters, and audit compliance on a sample of completions each month.
3. Enforce MFA: pilot conditional access with one practice group, keep a documented exception process and a break-glass account, then extend firm-wide; roll back an individual policy, not the whole control, if a matter system breaks.
4. Make incidents visible: route suspected phishing, odd mailbox rules and payment queries to one team so the firm, not just the individual, knows what has happened.
5. Exercise and refresh: run a yearly tabletop covering payment diversion and ransomware with data theft, including regulator and client notification, and update this page's figures when the ABA, SRA, Verizon or LexisNexis publish new editions.

Metrics that show the programme is working:

• MFA coverage: share of user and service accounts with enforced MFA or equivalent protection, target 100%.
• Payment verification: share of sampled transactions with a recorded call-back check.
• Mailbox rule alerts: suspicious forwarding or deletion rules detected and median time to remove.
• Reporting rate: phishing reports per 100 staff per month, and share of simulated phishing reported.
• Restore readiness: hours to restore the practice and document management systems in the last test.

Common failure patterns when using legal sector statistics

• Quoting old surveys as current: the SRA review is based on 2019 visits and the ABA figures here are from 2022. Always give the year.
• Treating lawyer surveys as firm counts: ABA, Proton and LexisNexis survey individuals; one firm may appear many times or not at all.
• Ignoring the "do not know" answers: 25% of ABA respondents did not know about breaches, so 27% is a lower bound, not a rate.
• Using Professional services figures as legal figures without saying so: the DBIR snapshot includes many non-legal firms.
• Reading falling reported losses as solved: SRA loss figures cover what firms report, and the SRA found significant ransomware incidents that had not been reported to it.

Methodology notes and caveats

Practitioner checklist

• Quote each figure with publisher, survey and year, and state whether it counts lawyers, firms or regulator reports.
• Label Verizon Professional services figures as a proxy for the legal sector.
• Treat self-reported breach rates as a lower bound because of "do not know" answers.
• Require call-back verification for every change of bank details and record it.
• Enforce MFA on email, document management and remote access for all users.
• Alert on new mailbox forwarding and deletion rules.
• Keep a short, tested incident plan that covers insurer, regulator, client notification and privilege.
• Bring AI use under a written policy with training.
• Refresh this page when the ABA, SRA, Verizon, LexisNexis or Proton publish new figures.

Standards and references

• Solicitors Regulation Authority: Cyber Security, A thematic review
• American Bar Association: 2022 Cybersecurity TechReport
• Verizon: 2026 Data Breach Investigations Report Executive Summary
• LexisNexis: Cyber security report 2025
• Proton: Law firms and cyberattacks survey
• Legal Futures: Client losses from cyber attacks on law firms continue to fall
• NCSC: Cyber threat report, UK legal sector

Related NHI Mgmt Group resources: Cybersecurity for Legal Firms Guide, Law Firm Identity and Data Security Guide, Legal Privilege in Incident Response Guide, Business Email Compromise and Fraud Statistics Guide, Data Breach Statistics Guide.