An international law firm has confirmed that a small number of internal documents were released on the dark web after unauthorized access. Reuters reported that the number of cyberattacks on law firms is increasing, and similar risks are also spreading to cryptocurrency trading platforms and hardware wallet service providers, with users' personal information becoming a frequent target of exposure.
Number of law firm incidents on the rise
Greenberg Traurig indicates that unauthorized individuals obtained and released a small number of files, but the specific content of these files was not disclosed, nor was the number of people affected made public. Public information suggests that it is not clear whether this incident involved customer identification information, health records, or other sensitive data.
Reuters, citing data from BakerHostetler, reported that the firm handled nearly 60 cybersecurity incidents involving law firms in 2025, which is nearly double the number in 2024. However, this figure only represents the cases it dealt with and does not equal the total number of security incidents across all law firms that year.
Phishing and outsourcing channels become entry points
BakerHostetler analyzed over 1,250 data security incidents across industries in 2025 in its 2026 incident response report. The report indicates that phishing attacks accounted for 30% of the identified causes, incidents related to external suppliers made up 25%, and 14% of the disclosed incidents ultimately led to class-action lawsuits.
According to the data disclosed, among the 482 incidents that were made public in 2025, 68 of them were subsequently prosecuted; in 2024, out of 518 incidents, 51 were prosecuted. The institution also pointed out that the relevant samples cover multiple industries and cannot be directly considered as a uniform proportion for the legal firm industry.
Cryptocurrency platforms also face similar risks.
The report mentions that the risks faced by American cryptocurrency users do not come solely from the transactions themselves. Even if platforms claim that funds, private keys, or wallet credentials have not been obtained, personal information such as names, addresses, phone numbers, images of identification documents, and purchase records can still be leaked due to third-party service providers or outsourced channels.
Coinbase disclosed in May 2025 that overseas customer service staff were bribed by criminals, resulting in the leakage of information on 69,461 users, including names, addresses, phone numbers, and images of government identification documents. The company stated that passwords, private keys, and customer funds were not affected, and they rejected a ransom demand of $20 million. At the same time, they offered a reward of the same amount to track down the attackers.
Wallet manufacturers successively disclose cases
Cases of hardware wallet manufacturers also mainly involve external partners. In January this year, Ledger stated that its e-commerce partner Global-e suffered from unauthorized access, and order information of some users who placed orders through Ledger.com was exposed. In August, SafePal reported that a vulnerability in an order tracking plugin exposed the information of approximately 39,798 customers, including names, emails, delivery addresses, phone numbers, and purchase details.
Trezor disclosed two separate incidents: the first involved its logistics partner ShipMonk, which led to the exposure of information on over 80,000 customers. Subsequently, it was added that the order records of approximately 67,000 American customers were also affected; the second incident was a breach in a third-party email service provider, where attackers impersonated officials to send "urgent security alerts" emails, enticing users to hand over their recovery phrases.
Additional information:On the same day, BitBox also reminded users to be cautious of emails sent in the name of the company, stating that their news email service provider might have been compromised. Earlier on, scammers had impersonated Trezor and Ledger to send physical letters to users, inducing them to scan QR codes and enter recovery phrases on malicious websites.
