The INC ransomware group has claimed responsibility for attacks on ten (10) law firms and legal services organizations over a 48-hour period, highlighting a potential coordinated campaign or shared upstream compromise. This cluster of activity is unusual and suggests a heightened threat to the legal services sector. The concentration of victims raises the possibility of a supply chain event affecting a common technology provider used across multiple firms. Law firms are attractive targets due to the sensitivity of client data and the urgency to resolve incidents quickly to protect attorney-client privilege. Between 2025 and early 2026, over 200 ransomware incidents were tracked in the legal sector, indicating a persistent threat. The INC ransomware group, known for double-extortion tactics, emerged in mid-2023 and typically exploits vulnerabilities in Citrix, Fortinet, and SimpleHelp RMM for initial access. Another group, Silent, has also targeted law firms since 2023 using phishing and vishing campaigns, focusing on data extortion without encryption, likely for espionage purposes. CTIX Analysts recommend that law firms should conduct a supply chain risk assessment, reviewing third-party dependencies and monitoring for indicators of compromise (IOCs). Incident response plans should be updated to address double-extortion scenarios. Additionally, deploying dedicated anti-ransomware solutions and validating backup and recovery procedures are crucial for mitigating risks. Organizations must ensure offline, immutable backups are current and tested to support recovery without relying on attackers’ decryptors.