Who's Targeting Legal Collections, and How to Stay Ahead of Them

NCBA has been alerted to an active email threat affecting vendors and creditors in our industry. The emails may appear to come from people you know whose accounts have been compromised and often include an RFP-related link or attachment. Please use caution: if you receive an RFP link or attachment, call the sender directly to confirm that they intended to send it.

We are sharing the article below as a reminder of cybersecurity best practices.

Who's Targeting Legal Collections, and How to Stay Ahead of Them

Not every cyberattack is immediately obvious. Some can appear legitimate on first view, and that’s what the attacker aims for: a fake RFP or invoice sent from a trusted vendor's hacked email account, just waiting for a click. Others are far bolder and tailor their attacks for a specific type of company or industry.

The Silent Ransom Group targets law firms directly, often posing as an IT help desk. According to a May 2026 FBI alert, when the ransom fails, the group has sent people to firms' offices posing as IT technicians to plug in a USB drive and walk out with client files.

The common thread is trust and a sense of urgency; a familiar sender, a helpful voice on the phone, someone who seems entirely plausible and fits a known profile. Attackers exploit human behavior because it works. Law firms are an obvious target, but legal collection agencies hold the same valuable data: Social Security numbers, account numbers and medical billing information, passed between creditors, agencies and the vendors that serve them.

For attackers, it’s a numbers game. They don’t need every attempt to succeed, just one to get through. When an account is compromised, fraudulent emails can come from a legitimate address belonging to a familiar contact. Because the sender is trusted, no email filter can guarantee the message won't reach you. Since these attacks work, it’s not just about prevention, more a combination of prevention and response and to limit damage when someone slips up.

When the breach isn't yours, but the data is

Some of the most damaging incidents involving legal collections even touched the victim firm's own network. Two recent cases show how.

A collection agency holding other companies' customer data. In 2024, attackers broke into a third-party debt collection agency harvesting names, birth dates, Social Security numbers and account data on 3.2 million people. One of its clients, a national telecom provider, had more than 230,000 customers exposed, even though it had stopped sending accounts to the agency years earlier. The client did nothing wrong that day. It was old data simply sitting vulnerable within a vendor’s environment.

A legal technology platform serving immigration law firms. In 2026, an adversary logged in to a case management vendor with stolen active credentials and copied code repositories tied to a data migration pipeline. The rewards, exposed sensitive data on 116,666 clients of the vendor's law firm customers. Affected clients weren't notified until 215 days after the breach, leaving multiple firms answering for an incident they couldn't see.

The pattern is the same each time. Clients' data sits with the vendors you chose, often long after you stopped using them, and when a vendor is breached, the duty to your clients remains in most cases.

What You Can Do To Reduce Your Risk

1. Make your email harder to fool

Ask your IT team or provider to confirm you have:

• Advanced email protection that flags phishing, dangerous links, malicious, and monitors for unusual sender behavior. Microsoft Defender for Office 365 and Proofpoint are two examples of excellent solutions.
• Impersonation alerts and Darkweb monitoring that catch look-alike names and domains pretending to be your leaders or vendors and that watches for leaked or stolen credentials.
• Link and attachment scanning that checks links when you click them and tests attachments safely before they open.
• Email authentication (SPF, DKIM and DMARC), which helps prevent attackers from spoofing your domain. It won't stop email from a vendor's real, hacked account, which is why the steps below matter.

2. Always verify before you trust

Attackers rely on you taking a message, call or visitor at face value. Build in a pause.

• Unexpected RFP or Invoice? Call the vendor at a number you already have. Don't reply to the email.
• Unexpected IT call? Hang up and call your help desk directly.
• Unexpected technician? Confirm with IT before they get past the front desk.
• Payment or remittance change? Collections teams should confirm any new bank details or payment portal by phone, using a number on file, before updating anything.
• Watch for red flags: new downloaded sites, password-protected files, unexpected login prompts, urgency, or changes to payment or contact details.
• Keep a verified vendor contact list so no one relies on details inside a suspicious email.

3. Limit the exposure to reduce damage if someone does click

• Use phishing-resistant MFA. Passkeys or security keys protect accounts even if a password is stolen.
• Block unapproved USB storage on company computers. This is the FBI's key defense against the in-person attacks.
• Protect every device with endpoint detection and response (EDR), which spots suspicious activity and can cut off an infected machine.
• Limit access so one compromised account can't reach everything.
• Watch for warning signs like unusual sign-ins or new email forwarding rules.
• Keep tested backups and a response plan so you can recover quickly.

4. Require vendors to observe the data security you need

The incidents above show that a vendor's weak spot becomes yours. Treat vendor security as part of your own.

• Know who holds your data. List every vendor that stores or touches client data: collection partners, e-discovery, document management, file transfer, billing and IT support.
• Assess before you sign, and again every year. Ask for SOC 2 reports or security questionnaires, and confirm MFA, encryption and incident response basics.
• Put it in the contract. Require breach notification within a set number of days, minimum security controls, and your right to audit.
• Get your data back when the work ends. Require return or certified deletion at contract end, so a vendor you left years ago can't expose you.
• Limit what you share. Send vendors only the data they need for the job.

5. Monitor the dark web for exposed information

Stolen credentials and company data circulates long after a breach. Dark web monitoring alerts you when your organization's or vendors' information shows up in monitored sources.

• Watch your own domains. Reset exposed passwords and investigate the affected accounts.
• Watch your critical vendors. A vendor's leaked credentials can put your systems and client data at risk.
• Act on alerts quickly. Confirm the data is real, disable exposed credentials, and decide whether more investigation is needed.
• Know the limits. Not every stolen record is found, and an alert doesn't always mean an account was compromised.

6. Train for and test the effectiveness of your response

Most phishing training teaches people to watch out for strangers. Today's attacks come from familiar names. Show your team what a fake vendor RFP looks like, what a fake help-desk call sounds like, and how to report something suspicious without clicking or forwarding it. Run practice phishing tests that look like real vendor emails.

When a vendor's account is hacked, silence lets the attack spread. If you're hit, warn your contacts. If you spot a fake, tell your IT team and your industry peers, and report it to the FBI at ic3.gov.

Start the process today

1. Have IT review your email protections and Microsoft 365 or Google Workspace settings.
2. Put a simple rule in writing: verify any unexpected RFP, IT call, visitor or payment change before acting.
3. Block unapproved USB storage on company computers.
4. Make it easy for employees to report anything suspicious.
5. List the vendors that hold client data and check each contract for breach notice and data return terms.
6. Evaluate dark web monitoring for your domains and critical vendors.

Get an independent view and validate

ConvergentDS helps law firms, collection agencies and financial services organizations find the gaps attackers look for before they do. We can review your Microsoft 365 or Google Workspace email security, assess the vendors that hold your client data, and test how your team responds to a convincing phishing email or help-desk call.

Not sure where you stand? Contact Leslie at lmartin@convergentds.com to schedule a review.