CrowdStrike reports a 129% rise in cyberattacks on U.S. law firms

What CrowdStrike reported

CrowdStrike, a cybersecurity company listed on the Nasdaq under the ticker CRWD, released its 2026 Legal Threat Landscape Report. Its headline finding is a 129% surge in cyberattacks on U.S. law firms, as Yahoo Finance reported.

The report also says attackers are mixing digital break-ins with physical tactics. The goal is to get at confidential legal material and information about deals. The coverage does not spell out what the physical tactics look like, so we will not guess.

On the same day, the company announced a separate piece of news: an AI-native security integration with NVIDIA, aimed at protecting AI agents. The two items sit side by side in the coverage, but they are different stories.

Why law firms are a tempting target

The logic is simple. Law firms hold sensitive client records and deal-related information, the kind of material that is valuable to anyone who wants an edge in a negotiation or a lawsuit. A single firm may hold secrets from many clients, so one successful break-in can expose a lot of other people's data.

That is also why the lesson reaches beyond law. Accountants, consultants and other small professional firms hold similar material, often with smaller security teams than the companies whose secrets they keep.

A caution is needed about the number itself. The coverage gives no time period for the comparison, no starting figure, and no definition of what counts as an attack. It also does not say whether the data comes from CrowdStrike's own customers or a wider sample. A 129% rise could be large or small depending on the baseline.

The NVIDIA tie-up and AI agents

An AI agent is software that can take actions on its own, such as reading files, calling tools or moving data, rather than only answering questions. As companies put agents deep into daily work, those agents become something that needs protecting.

CrowdStrike says its new integration with NVIDIA aims to guard agents at both the software level and the silicon level, meaning the chips themselves. It extends what the company calls AI Detection and Response from software into NVIDIA's OpenShell and Sentry. The idea is to connect three things: how an agent behaves, enforcement at the hardware level, and the wider picture from CrowdStrike's Falcon platform.

The coverage ties this to existing CrowdStrike products named Guardian and SafeMind, and to Falcon Flex, a way of bringing more of a customer's security spending onto one platform. The same platform spans endpoints (laptops, phones and servers), identities and cloud environments.

How to read the commercial angle

The Yahoo Finance piece is written for investors, and it links the two announcements to CrowdStrike's business story. It argues that the law firm findings show why a broad platform matters, since a breach pattern like this touches endpoints, sign-ins and cloud systems at once. It also suggests AI security could become a multi-billion pillar of annual recurring revenue (ARR, the yearly subscription income a company can count on), alongside next-generation SIEM (software that gathers and analyzes security logs), identity security and cloud security.

That is a possibility the article describes, not a result. A vendor that reports a surge in threats is also showing why its products are needed, so it is sensible to hold the finding at arm's length until the method is visible.

The article says the proof will come in later disclosures. Investors are advised to watch whether management points to changes in ARR growth, or ARR per customer, linked to Falcon Flex and AI agent protection after the report and the NVIDIA rollout.

What a reader can take from it

You do not need to own the stock to use the story. The practical question is whether the people and systems that guard your clients' or customers' information would hold up against a determined attempt.

• Know who has access to sensitive client files, and remove access that is no longer needed.
• Turn on multi-factor sign-in, which asks for a second proof of identity beyond a password.
• Rehearse what you would do in the first hours after a breach.

The mention of physical tactics is a reminder that security is not only about software. Who can walk into the office or reach a device matters too.