Phishing Emerges as Top Threat in Legal Industry Amidst Inadequate Cybersecurity Measures

The legal industry faces a growing cybersecurity crisis, with phishing attacks now ranking as the top threat, according to a recent report by Fenix24 and the International Legal Technology Association (ILTA). The findings underscore a critical shift towards more sophisticated, human-operated cyberattacks, leaving many law firms vulnerable due to inadequate defenses and recovery plans.

The report, titled 'Security at Issue: 2025 State of Cybersecurity in Law Firms,' highlights that only 50% of law firms have immutable backups, a crucial defense against data loss and ransomware attacks. This lack of preparedness is alarming, considering the increasing sophistication of cyber threats targeting the legal sector. John Anthony Smith, Founder & Chief Security Officer of Fenix24, emphasized the shift from malware-based attacks to targeted campaigns, pointing out the industry's lag in adapting its defenses.

Further findings reveal inconsistent application of Multi-Factor Authentication (MFA) across high-value systems, with only 18% of firms applying MFA to production storage. Additionally, a decline in security confidence among firms, from 50% in 2023 to 38% in 2024, reflects the growing recognition of cybersecurity gaps. Despite these challenges, the report notes a positive trend towards proactive vulnerability management, with external assessments and tabletop exercises driving security investments.

Corey Simpson, Chief Operating Officer at ILTA, stressed the importance of moving beyond compliance to ensure recovery readiness. The report serves as a call to action for law firms to invest in robust cybersecurity measures, including immutable backups and tested incident response plans, to safeguard sensitive client data and maintain trust. For more details, the full report is available at https://fenix24.com/iltareport2025/.