A law firm’s cybersecurity exposure can extend well beyond its email system and document repository.
New research from CrowdStrike identifies timekeeping and billing software as one route attackers have used against the legal sector.
The company’s October 28 report says extortion groups named 455 legal entities on dedicated leak sites between September 2025 and August 2026, a 39% increase over the preceding period.
What the figures measure
These are CrowdStrike’s reported observations, not an independently audited census of attacks on every law firm.
An appearance on a criminal leak site is also a particular metric. It should not be treated as interchangeable with the total number of attempted intrusions, confirmed breaches or affected clients.
The scope matters because the report describes threats across legal entities, rather than a verified count limited to Canadian law firms.
Why billing software matters
CrowdStrike reports that a China-linked threat actor exploited a vulnerability in Intapp Time Server, software used for legal timekeeping and billing. The public summary does not identify the affected firms. The attribution and technical account are the vendor’s findings.
The practical implication is that routine operational systems belong in a firm’s security assessment. They can contain sensitive information about clients, work performed and commercial relationships, and may connect to other parts of the network.
What firm leaders should examine
Useful questions include who maintains these applications, how vulnerabilities are tracked, which accounts can access them and whether an incident-response plan covers them.
The research also gives firms a reason to test how staff verify purported IT requests. CrowdStrike describes attackers impersonating technology personnel to obtain access.
The report’s strongest lesson is concrete: systems used to run the business of law can also expose the information entrusted to it.
Sources: Reuters report · CrowdStrike’s research summary · Report page
Related coverage: More Law Firm Cyber Incidents Put Remote Access and Individual Devices Under Scrutiny.