Phishing Emerges as Top Threat in Legal Industry, Highlighting Cybersecurity Gaps

The legal industry is facing a critical juncture in cybersecurity, as revealed by the latest joint report from Fenix24 and the International Legal Technology Association (ILTA). Titled 'Security at Issue: 2025 State of Cybersecurity in Law Firms,' the report sheds light on the escalating threats and preparedness gaps within legal organizations globally. Phishing has emerged as the predominant threat, overtaking traditional concerns like ransomware, with 50% of respondents identifying it as a top risk.

John Anthony Smith, Founder & Chief Security Officer of Fenix24, highlighted the shift from malware-based attacks to more sophisticated, human-operated campaigns. This evolution in threat tactics underscores the inadequacy of current defenses in many law firms. The report further reveals that only 50% of firms have immutable backup systems, a critical component for recovery post-attack, with a mere 27% prioritizing backups as a top security measure.

Multi-Factor Authentication (MFA), a key defense mechanism against ransomware, shows inconsistent application across high-value systems. The report notes that only 18% of firms apply MFA to production storage and 37% to backup storage. This inconsistency, coupled with a decline in security confidence among firms—from 50% in 2023 to 38% in 2024—paints a concerning picture of the sector's vulnerability.

Corey Simpson, Chief Operating Officer at ILTA, emphasized the necessity for the legal industry to transcend compliance and focus on recovery readiness. The report advocates for investments in rapid operational restoration capabilities and the protection of sensitive data under duress to maintain client trust. For a comprehensive understanding of the findings, the full report is available at https://fenix24.com/iltareport2025/.

The findings of the Fenix24 and ILTA report serve as a wake-up call for the legal industry, urging immediate action to address the identified cybersecurity gaps. As threat actors continue to refine their tactics, the need for immutable backups, consistent MFA application, and proactive security investments has never been more critical.