Updated for 2026
A Record Year for Law Firm Attacks
2023 set a grim record: 45 ransomware attacks on law firms. That is the highest count ever logged. These attacks hit over 1.6 million records. Ransom demands averaged $2.47 million.
The legal sector has become a prime target. The threat is not slowing.
Why Law Firms Are Prime Targets
Law firms hold some of the most valuable data anywhere:
- Client secrets protected by attorney-client privilege
- Merger and deal details worth millions
- Court strategies rivals would pay to see
- Personal data of high-net-worth clients
- Trade secrets shared in legal cases
Attackers know firms will pay. They pay to stop both theft and public exposure.
The Financial Impact
| Metric | Value | Source |
|---|---|---|
| Average breach cost | $5.08M | Embroker 2024 |
| Average ransom demand | $2.47M | Comparitech |
| Firms with response plans | 34% | ABA 2023 |
| Firms that lost client data | 56% | ABA Survey |
| Orrick settlement | $8M | Court filings |
A law firm data breach cost $5.08 million on average in 2024. That is a 10%+ rise from the prior year. And it only covers direct costs.
Case Study: Orrick, Herrington & Sutcliffe
In November 2024, Orrick agreed to pay $8 million. This settled class action claims from a March 2023 breach.
The breach hit 638,000+ people. Only 153,000 were first reported. Stolen data included names, addresses, dates of birth, and Social Security numbers.
The irony: Orrick helps firms that have faced security breaches.
The Redaction Problem
A top cause of data exposure is not hacking. It is improper redaction.
Many lawyers use Word's highlight tool to "redact" documents. This does not remove data. It only covers it. Recipients can:
- Select and copy the "redacted" text
- Remove the highlight
- Use PDF tools to pull hidden content
Courts have fined attorneys for these errors. One judge demanded counsel explain "technical weakness" in their redaction process.
True Document Redaction: The Fix
anonym.legal's Office Add-in gives true redaction in Microsoft Word. Learn more on the security and compliance page and in the legal conformance docs.
How It Works
- Select text in your Word document
- Click "Anonymize" in the anonym.legal add-in
- PII is found and replaced with tokens
- The text is actually replaced—not just hidden
Key Features for Legal
- Reversible encryption: Keep originals with keys
- Batch processing: Handle entire case files at once
- Audit trails: Record what was removed and when
- Format preservation: Document layout stays intact
Why Reversibility Matters
anonym.legal uses AES-256-GCM encryption. It can be reversed with the right key. This matters because:
- Courts may need the original document
- Opposing counsel may contest redactions
- Internal review may need full text
- Auditors may request un-redacted versions
Security Beyond Redaction
Proper redaction is key. But it is only part of the answer. Law firms also need:
AI Chat Protection — Associates use ChatGPT for research. Are they pasting client data? The token system stops that at the source.
Email Scanning — Scan for accidental PII before sending files out.
Document Classification — Know which files hold privileged data before sharing.
Getting Started
Protect your firm today:
- Download Office Add-in — True redaction in Word
- Install Chrome Extension — Guard AI usage
- Start free trial — 200 tokens to test
When This Approach Has Limits
True redaction and AI-paste controls reduce a law firm's exposure, but they are not a complete defense and should be planned with their limits in mind.
Redaction is one control, not the whole defense. Replacing visual highlighting with true redaction closes one common leak, but ransomware crews exfiltrate whole files — including documents that were never redacted at all. Redaction protects what you ship outward; it does not stop an intruder who already has network access from taking everything else.
Detection is probabilistic, so a privileged name can still slip through. Automated detection misses some identifiers and flags some non-identifiers, and the miss rate rises with scanned exhibits, handwriting, and unusual name formats. For privileged or court-bound material, a human reviewer still has to check the output before it leaves the firm.
Reversible protection is only as strong as key custody. Tokenization lets you restore originals when a court or auditor needs them, but anyone holding the key holds the data. If that key is stored carelessly — or sits on a machine the attacker reaches — reversible protection offers little against the breach you are trying to prevent.
Tools do not replace the duty of competence. Encryption, redaction, and paste-blocking are safeguards a firm chooses and configures; they do not discharge the attorney's professional obligation to supervise how client data is handled. Treat them as part of an incident-response and training program, not a substitute for one.