Law Firm Data Theft and Extortion: Responding When Files Are Stolen Without Encryption

By Ahmet Karaca · Published 20 October 2026 · Sources checked: 20 October 2026

A law firm’s files can be stolen while its systems continue to work normally. There may be no encrypted documents, locked screens or obvious outage. A demand threatening to publish client records therefore calls for a confidentiality investigation even when staff can still open every file. Contain the suspected access, preserve the evidence and identify which client matters may be affected. Restoring a backup cannot reverse a disclosure.

The immediate question is not simply whether an attacker can prove their threat. It is what the firm can establish about access, copying and exposure, and what protective decisions must be made while some facts remain uncertain.

Why law firms need a response beyond encryption recovery

The FBI’s 2025 IC3 report identifies legal services as 18% of more than 1,400 ransomware complaints from businesses and organisations outside the critical-infrastructure sectors. That is a share of those reported complaints, not a claim that 18% of law firms were attacked, and it does not measure every data-theft incident. Source: FBI IC3 2025 Annual Report, page 16.

The FBI’s currently hosted Silent Ransom Group notification describes law-firm targeting through IT-themed deception. It includes both remote-access approaches and people presenting themselves in person as IT support. Data is stolen and used for extortion. The presence of an ordinary administration tool is only a potential indicator, not proof of this group’s involvement.

The joint CISA, FBI, NSA and MS-ISAC StopRansomware Guide, available from IC3, also recognises data theft and threatened release without encryption. A working document system should not close the investigation.

Start a controlled response through a trusted channel

Appoint a senior decision-maker and a technical incident lead. Use an independently verified contact for the firm’s genuine IT provider; the person who offered “support” may be the entry point. Establish a communication route that does not depend on the potentially compromised mailbox or messaging account.

Coordinate containment with evidence preservation. Responders may need to restrict remote access, accounts, sessions or affected devices while retaining logs and forensic material. CISA recommends isolating affected systems and protecting volatile or short-retention evidence. Decisions about shutdown, collection and recovery should be made by the response team; do not delay necessary containment while trying to assemble a perfect record.

Keep a decision log: who authorised the action, the time and time zone, what changed, and why. Record any unavoidable gaps, such as a service whose logs were already overwritten. Avoid installing new cleanup tools or wiping a workstation simply because no files appear to be encrypted.

Separate the extortion claim from the technical findings

An extortion email can contain genuine names or documents without proving that the attacker obtained the whole repository. Conversely, the absence of a sample does not prove that no theft occurred. Ask investigators to distinguish the following states for each relevant system:

• Claimed: the sender says they possess material, but the firm has not corroborated the claim.
• Access established: records show unauthorised access, while the extent of copying remains unresolved.
• Transfer or possession supported: available evidence supports copying or possession of identified material.
• Unresolved: the evidence is insufficient to reach a reliable conclusion.

These are an assessment framework, not technical certifications. A large outbound transfer needs context, including its source, destination and whether it was authorised. A legitimate sync job and an unauthorised export may look similar in a simple volume chart.

Preserve the demand, original messages, received voicemails, payment address and claimed file list. Let qualified responders handle suspect attachments or samples in a controlled environment. Do not circulate client documents across the firm to ask whether anyone recognises them, or ask the attacker to send more confidential material.

Map technical findings to client matters

A server name does not tell a partner which clients need attention. Build a restricted record linking systems and accounts to matter files, dates and data types. Keep the detailed inventory secure; the incident tracker itself may reveal sensitive client information.

Do not assume that a permission list is a list of stolen files. Permissions describe potential reach; access and transfer evidence describe what is known to have happened. Where logs cannot resolve the difference, preserve that uncertainty in the assessment instead of converting it into “no exposure.”

Assess communication and notification duties alongside the investigation

The applicable jurisdiction, client relationship, affected information, contractual commitments and insurance terms can change what the firm must do. Obtain advice on the actual circumstances, including professional and data-protection obligations. There is no single worldwide notification deadline for a law firm.

Do not wait for a complete attribution report before beginning that assessment. Record the facts currently known, the unanswered questions and the basis for each communication decision. Use suitable independent advice where the firm’s own interests may diverge from a client’s. Avoid promising that an internal label or the involvement of a lawyer automatically protects every incident document from disclosure.

When communication is necessary, distinguish confirmed findings from the investigation’s remaining scope. “We have no evidence of copying” needs context if the relevant logs do not exist. Give affected recipients a genuine contact route, particularly if an attacker could imitate the firm’s email or payment instructions.

Report through an appropriate, controlled channel

The FBI notification requests information that can lawfully be shared, including extortion communications, contact numbers, cryptocurrency wallet details and the particular sensitivities of stolen data. Reporting should not become an uncontrolled transfer of whole client files. Identify a responsible contact and agree how evidence will be supplied securely.

Use the competent local authorities and relevant incident-reporting routes. A US report may be relevant to a cross-border incident, but does not replace the firm’s local obligations; our cross-border IC3 reporting guide explains that channel’s limits.

Verify IT visits and remote-support requests

The Silent Ransom Group notification recommends checking people entering firm premises and establishing how genuine IT staff authenticate themselves. A credible badge, familiar product or calendar invitation should not replace verification through the firm’s existing process.

Connect each support visit or remote session to an authorised request: named provider, confirmed technician, approved device and purpose. If someone arrives unexpectedly to attach a device, stop access and confirm the appointment with a known contact. Staff should be able to challenge the request without first deciding whether the visitor is a criminal.

Keep extortion decisions separate from recovery claims

A promise to delete stolen files does not demonstrate that every copy has been destroyed. Decisions about engagement or payment require technical, legal and operational assessment; a demand should not become the firm’s incident plan. Preserve communications and avoid letting an attacker dictate which clients or authorities may be contacted.

For encrypted systems and service interruption, see our ransomware response guide. For redirected client or supplier payments, use the separate business email compromise guide. The 2025 IC3 report analysis explains the statistical context; the firm’s own records determine its exposure.