Ransomware Is No Longer Only Attacking Your Firm. It Is Targeting Your Clients.

For years the conversation about ransomware in law firms has been about systems. Files get encrypted. Billing stops. Nobody can open a matter file or a calendar. Those consequences are real and they are serious.

A recent campaign suggests the conversation needs to widen.

According to research published by SOCRadar, a campaign attributed with high confidence to INC Ransom assigned each of twenty-four U.S. law firms its own extortion website. The sites reportedly used firm-specific domain names, countdown timers to publication, allegations about exposed client information, and photographs of firm employees. SOCRadar assessed that these pages were likely shared with clients in order to intensify pressure on the firms.

The design matters. A traditional leak site sits on the dark web and requires specialized software to reach. An ordinary website can be opened by anyone and forwarded by email or text. That is a deliberate choice, and it tells you what the attacker was trying to achieve.

The objective was not only to disable technology. It was to make clients question whether the firm they trusted with their most sensitive matters had protected them.

A different kind of business interruption

When ransomware locks a server, the disruption initially looks operational. Attorneys cannot reach documents. Staff cannot access calendars. Invoices cannot go out. Deadlines get harder to manage.

A client-facing campaign expands that considerably. Now partners are also handling frightened clients, urgent calls, questions about notification obligations, and the possibility that stolen information will be used for further fraud against the people who trusted them.

The incident stops being an IT matter. Firm leadership, breach counsel, the cyber insurance carrier, and practice leaders all need to coordinate quickly, often while normal communication channels are unavailable. Every delay adds uncertainty. Every inconsistent message costs confidence.

There is a second effect that firms rarely plan for. Client pressure pulls the people you need for recovery into other work. Partners leave the response to answer calls. Administrative staff struggle to separate legitimate client inquiries from fraudulent ones. The bottleneck turns out not to be the technology but the firm's ability to prioritize decisions while everything is happening at once.

What the numbers do and don't tell us

SOCRadar reported that ten of the twenty-four firms later appeared on INC Ransom's leak site, and fourteen did not.

It would be easy, and wrong, to conclude that the fourteen paid. SOCRadar cautioned against exactly that reading. Absence from a leak site could reflect an ongoing negotiation, a partial arrangement, a delay, or any number of outcomes that cannot be observed from outside. I have no information about what any of these firms decided, and neither does anyone else looking at this from the outside.

The useful lesson isn't about payment. It's that criminals believe client pressure works. Whether or not that belief was correct in any individual case, other groups can copy a tactic that appears to generate urgency.

Preparation has to include the client relationship

The technical safeguards still matter. Multifactor authentication across every system, not just email. Tested backups, where someone has actually performed a restore. Endpoint monitoring, controlled privileged access, secure remote access, timely patching.

But none of that prepares a firm for a client who calls having already read the attacker's page.

A complete plan answers a different set of questions. Who has authority to declare an incident. How leadership communicates when firm email cannot be trusted. Which clients need priority attention because of imminent deadlines or particularly sensitive matters. How facts get verified before anyone makes a statement. Where current contact information lives, and whether it can be reached if the network cannot.

These plans need to be tested, and the test that works is a tabletop exercise: put the leadership team in a developing scenario with incomplete information and a clock, then write down where authority, communication, or recovery assumptions break. The value is in finding those gaps while you still control the timing.

Ransomware is no longer only an attack on computers. It can be an attack on the confidence that lets a firm operate at all. That makes readiness a client service question as much as a technology one.

If an attacker contacted your clients before your firm could contact them, would your leadership team know what to do in the first hour?

---

Sources: SOCRadar: INC Ransom Targeted 24 Law Firms, but Only 10 are Listed; Halcyon: INC Ransom Group Mounts Rapid Campaign Against Law Firms