Ransomware Attacks on Law Firms Surge in 2025, Fueled by AI and Sophisticated Tactics BakerHostetler’s 2026 Data Security Incident Response (DSIR) Report, released on March 26, 2026, reveals a sharp escalation in ransomware attacks targeting law firms, with incidents nearly doubling over the previous year. The report, based on data from 2025, highlights law firms as prime targets due to their troves of sensitive client data, making them vulnerable to extortion and financial fraud. Key findings from the report include: - Attack Vectors: Phishing remained the leading entry point (nearly one-third of breaches), while 25% involved third-party vendors. Outdated or insufficient endpoint detection and response (EDR) systems accounted for 21% of intrusions. - Tactics: Attackers employed data exfiltration for blackmail, encryption to lock victims out, and email hijacking to expand phishing operations. Wire fraud alone siphoned over $15 million in 2025, with only 27% recovered. - Ransom Demands: The average initial demand surged 70% to $4.2 million, while actual payouts averaged $683,000 a 34% increase. Negotiations typically lasted 20 to 60 days. - AI Exploitation: Cybercriminals leveraged AI to accelerate attacks, while "Shadow AI" unauthorized generative AI tools used by employees created new vulnerabilities by exposing sensitive data. - Notable Threat Actors: The ransomware group Chatty Spider (also known as Luna Moth or Silent Ransomware) combined social engineering with direct calls to attorneys, impersonating IT staff to gain access. Demands ranged from $500,000 to $21 million, with payouts averaging $450,000. The report underscores the growing sophistication of ransomware operations, with law firms facing heightened risks of data breaches, contractual violations, and ethical repercussions. Despite 19 states adopting data privacy laws by early 2026, law enforcement continues to lag behind cybercriminals, leaving firms to bolster their defenses independently.

OCR Ramps Up Enforcement Against Healthcare Business Associates in 2025 In 2025, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) intensified its enforcement actions against healthcare business associates, marking a shift in regulatory focus. According to BakerHostetler’s annual Data Security Incident Response Report, which analyzed over 1,250 incidents across industries, OCR issued 12 enforcement actions down from 23 in 2024 but with a notable emphasis on third-party vendors. Seven of the 12 resolutions targeted business associates, doubling the total number penalized since they first came under OCR’s purview in 2013. The agency also prioritized security risk analysis violations, imposing four penalties in 2025. However, OCR signaled a potential shift in 2026, opting for technical assistance over investigations for breaches affecting fewer than 500 individuals, likely due to staffing constraints and a focus on larger incidents. While federal enforcement may ease, state attorneys general (AGs) filled the gap in 2025, launching independent investigations even after OCR closed cases. Leveraging HIPAA, state privacy laws, and consumer protection statutes, AGs targeted both vendors and providers, particularly when breaches disproportionately impacted local residents. Healthcare breaches remained costly, with vendors accounting for over a third of incidents handled by BakerHostetler. Ransomware attacks persisted as a major threat, with an average demand of $18 million and an average payout of $1.2 million the highest across industries. Recovery took an average of 12.7 days, with forensic investigations costing $40,000. Looking ahead, AI adoption and vendor management challenges are expected to complicate cybersecurity efforts in 2026, as regulatory uncertainty and evolving threats shape the healthcare landscape.