M&A and Litigation Documents Identified as a Distinct Extortion Target Class

Reporting on legal sector exposure lists what firms hold: client contracts, M&A documents, litigation strategy, discovery files, billing records and regulated client data. Those categories behave very differently once taken.

Advance knowledge of an unannounced transaction is directly tradeable, and it is worth a great deal for a short period. After announcement it is worth nothing.

That produces an attacker profile unlike anything else in this database. There is no extortion note and no leak site, because publication destroys the value. Success looks like nothing happening, and the firm may never learn it was compromised.

A party’s assessment of its own case — where it is weak, what it will settle for, which witnesses worry it — is valuable to exactly one buyer: the opposing party.

It also has a longer window than deal information, lasting for the life of the proceedings, and its use may be undetectable. An opponent who negotiates unusually well is not evidence of anything.

Discovery material is frequently the largest volume a firm holds and belongs to third parties who are not the firm’s clients — employees whose messages were collected, customers whose records were produced.

None of them chose the firm, and most do not know a copy of their correspondence sits on its systems. It is the aggregation problem filed at 26-0622 in a different sector.

A firm looking for encryption or an extortion demand will not find the intrusions that matter most here. The category that should worry a firm advising on transactions is the one that takes a specific folder quietly and leaves.