Law-Firm Attacks Nearly Doubled. The On-Chain Ransom Ledger Tells a Different Story.

On September 10, Greenberg Traurig — an international firm with more than 3,200 lawyers — told Vermont's attorney general that an "unauthorized actor" had accessed a "limited number of documents" and posted them to the dark web. The disclosure noted Social Security information. Greenberg stressed that its own systems were not compromised and that only a "small number of affected clients" were notified. On its face, a contained incident. The headline around it was not.

"Cyberattacks on law firms nearly double" is a number worth checking, because almost everyone quoting it is citing the same source: BakerHostetler, an incident-response law firm that tracks its own caseload. In its 2026 Data Security Incident Response Report, based on more than 1,250 incidents across industries in 2025, BakerHostetler said it responded to nearly 60 law-firm incidents last year — almost double the prior year. Phishing accounted for 30% of the total.

That is a frequency report, and it is issued by the people paid to clean up. Before turning it into an investment signal, it is worth asking two things the headline does not answer: who keeps the other ledger, and whether the two are moving together.

The receipts: a running list, not a single breach

Greenberg is the fresh entry, not the outlier. The disclosures trail across 2026 on a familiar vector — social engineering, the manipulation of a person rather than the cracking of a system. Taft Stettinius & Hollister reported unusual activity in March that exposed client Social Security numbers; Herbert Smith Freehills Kramer disclosed a May breach touching Social Security, government ID, and health records; WilmerHale drew a proposed class action in July after a May breach; Goodwin Procter disclosed an incident on August 7; Quinn Emanuel flagged an August 14 social-engineering attack on one account; Eckert Seamans disclosed a social-engineering breach that exposed dates of birth and Social Security numbers and drew class actions in New York; McDermott Will & Emery and Weil Gotshal each confirmed similar episodes in May. Fox Rothschild confirmed a May breach as a class action was filed.

The pattern across firms is the vector: not malware that slips past a firewall, but an email or a phone call that persuades someone inside to hand over access. The FBI, per reporting, has warned that a ransomware group is targeting large law firms precisely with these tactics. In that light, "nearly double" reads less like a single hack and more like a structural shift in who is being aimed at and how.

The second ledger: what the attackers are actually paid

Here is where the frequency count stops being self-explanatory and starts diverging from the other ledger — the one on which ransom money actually moves. That ledger is on-chain, and it is measurable.

The blockchain-analysis firm Chainalysis reports that total on-chain ransomware payments fell by roughly 8% to about $820 million in 2025, even as claimed attacks rose about 50%. The median payment, meanwhile, jumped 368% year over year to around $60,000. That is a counterintuitive pair: more attacks, less aggregate extortion revenue, but a far larger check per victim who does pay. Law-enforcement seizure and victims refusing to pay appear to be squeezing the aggregate; the remaining payers are being hit harder.

This matters because it separates the two things a headline can conflate. The near-doubling BakerHostetler reports is frequency — incidents, disclosures, class actions. The Chainalysis figure is the payment channel. Frequency and payment are not moving together, and that divergence is the actual story.

Who that divergence reprices

The exposure lands on the books that insure this risk — and the pricing there shows the same split. U.S. cyber insurance direct written premiums grew nearly 11% in 2025, with policy count up roughly 34% (Fitch, April 2026). Meanwhile, market-tracking reports describe about 11% (Lockton, May 2026), even as incident frequency surged. Growing written volume is not the same as growing per-unit price: more policies and more premium dollars are entering a book whose average rate is getting cheaper while claims frequency climbs. That combination — rising frequency, falling price — is the configuration that compresses an insurer's margin, not the one that produces a windfall.

There is a second, quieter reprice: the burden is shifting from paying the ransom to paying for what comes after. Nearly every prominent 2026 case runs through social engineering and ends in exposed Social Security numbers and proposed class actions. The tradable "asset" being taken is no longer bitcoin — it is personally identifying information that generates litigation against the firm. The identity that changes is the law firm's: from custodian of client secrets to defendant, with no on-chain recovery route for that loss.

A word of caution before treating every headline as a tailwind for security vendors. When the dominant infection vector is a person clicking and confirming, the fix is training, process, and incident response — not pure software spend. A breach count that doubles does not map one-for-one onto firewall revenue.

The break condition

The read here is built on one observable: an incident-frequency ledger and a payment ledger that are moving apart. The number to watch is whether they re-sync. If on-chain ransom payments stop shrinking and start climbing alongside the doubling incident count, the "insurers are absorbing rising frequency at falling prices" tension becomes a claims-loss problem, and the divergence closes. If rates re-harden while incidents keep rising, the margin pressure reverses in the other direction.

Until then, "law-firm attacks nearly doubled" is a true sentence and a useful canary — but it is a frequency report written by the cleanup crew, not a receipt for an industry's profit. The receipts are the two ledgers, and right now they disagree.