Resources

In 2025, professional services ranked among the top three most affected sectors by ransomware globally, according to a threat intelligence report from QBE. So far in 2026, the sector remains in the top five.

Two Australian law firms, one in New South Wales and one in Adelaide, were listed by a ransomware group called Lynx during 2025. They are far from the only firms being targeted. Highly capable, well-resourced ransomware groups are treating accounting and legal firms as a priority, not an afterthought.

This post looks at what is happening, and what accounting and legal firms need to do to stay safe.

The numbers you need to know

Here are the key data points accounting and legal firms should be aware of.

• Average ransomware demands against the legal sector rose from $383,000 in 2024 to $611,000 in 2025, an increase of 60 percent in a single year

• Ransomware attacks against the legal sector rose 54 percent over the same period

• The number of publicly listed ransomware victims worldwide hit an all-time high in 2025, at 8,159, up from 6,129 in 2024 and 5,336 in 2023

Much of this growth is being driven by newer groups, including Qilin, Lynx, INC, and Dragonforce. These groups are actively naming accounting and legal firms on their leak sites, and Australia is one of the countries most affected.

How ransomware groups are getting in

Social engineering is a significant factor behind these attacks. QBE’s research points to groups like Scattered Spider, who use phone calls to IT service desk staff to obtain employee credentials. A caller poses as a staff member locked out of their account, talks their way past verification, and uses the credentials they are given to bypass access controls and multi-factor authentication.

Other groups use different tactics. Silent Ransom Group, which almost exclusively targets law firms, sends spam emails about fake subscriptions, then convinces the recipient to call a support number and install remote access software. Some groups are also buying stolen access outright from initial access brokers on cybercriminal forums, rather than breaking in themselves.

The common thread is that these groups are exploiting people and processes, not just technical vulnerabilities. That is why generic phishing awareness training is not enough on its own.

It is already happening to Australian firms

These are not just offshore statistics. In July 2026, AC Small Maxwell & Co, a NSW-based accounting and advisory firm, was allegedly listed on the leak site of a ransomware group called SafePay, which threatened to release stolen data within days. The firm has not confirmed the claim, and the group provided no proof the data was genuine, but the listing alone shows how quickly a firm’s name can end up on a leak site.

Smaller and long-established firms are not exempt. The size or history of your practice will not protect you.

What you can do about it

The good news is that meaningful protection does not require the resources of a large enterprise.

• Use tested, offline backups. Ransomware groups are increasingly targeting backups directly, so backups that stay connected to your network are not enough on their own.

• Train staff specifically on helpdesk and callback phishing, not just generic phishing awareness. The techniques above rely on a helpdesk operator being talked into something they should not do.

• Build and rehearse an incident response plan, and make sure every employee knows what to do and who to call if an attack happens.

Work with Aryon

At Aryon, our job is to make sure you are prepared well before an attack happens, so you are not scrambling to defend your business during or after one.

Our managed services are built to handle your security needs and help you build strong, sustainable defences, so your team can focus on what they do best. Get in touch with us to find out more.