LSBC 10-4 Report Data Shows Cybersecurity Attacks Are Increasing

We asked the Law Society of British Columbia for the full decade of Rule 10-4 reports — the mandatory disclosures lawyers must file when their computer or server is hacked. The numbers tell a clear story: cyber incidents at BC law firms are not a growing risk. They're a growing reality.

The full series: 2016–2026

The Law Society provided the complete record of Rule 10-4 reports from 2016, when mandatory reporting began, through October 30, 2026. Here is every year on file:

The trend isn't linear. It's accelerating.

The headline number is the 8.5× increase from 2016 to 2025. But the more telling story is in the year-over-year growth rates — they reveal distinct phases that a single headline number hides.

Phase 1: Early growth (2016–2018)

Reports tripled from 4 to 15 in two years. This is the early period — low baseline, rapid percentage growth, likely driven by a combination of rising attacks and growing awareness of the reporting obligation. Rule 10-4 was new; lawyers were learning it existed.

Phase 2: The pandemic dip (2019–2020)

Reports declined 27% over two years (15 → 12 → 11). This coincides with the pandemic period, when many firms rushed to remote work — which should have increased exposure. The fact that reports went down suggests either under-reporting during the chaos of 2020, or that the shift to cloud platforms (Microsoft 365, Google Workspace) temporarily reduced traditional server compromise incidents. Either way, the dip was temporary.

Phase 3: Sharp acceleration (2021–2023)

Reports jumped 73% from 2020 to 2021, then climbed to 27 in 2022 and held at 27 in 2023. The plateau at 27 may represent a temporary ceiling — or attackers refining their targeting of law firms specifically. Professional services was the #1 most-affected sector in the 2025 NetDiligence Cyber Claims Study, accounting for 18% of all claims.

Phase 4: False hope, then surge (2024–2026)

2024 dipped to 22 — an 18% decline. Optimists called it a sign the problem was stabilizing. They were wrong. 2025 jumped 55% to 34. 2026 is already at 40 with two months remaining, on pace for approximately 48 by year-end. That's not stabilization. That's acceleration.

The compound annual growth rate (CAGR) from 2016 to 2025 is 26.5%. But the CAGR from 2020 to 2025 is 25.3% — nearly identical. The trend rate hasn't slowed despite a decade of awareness, security tooling, and regulatory attention. If anything, the last two years suggest it's getting worse faster.

2026 is already a record — and it's not over

At 40 reports through October 30, 2026 has surpassed every full year on record with two months still to go. At the current pace of roughly 4 reports per month, the year would end near 48 reports.

That means in 2026, more than one BC law firm per month is reporting a hacked computer or server to the Law Society. And these are only the firms that reported — the real number is certainly higher.

Half the decade's reports in the last 22 months

Of the 220 total reports since 2016, 96 were filed from January 2025 onward. That's 44% of all documented incidents crammed into the most recent 22 months of a 130-month reporting window.

This isn't a gradual upward drift. The curve is bending steeply. If 2026 ends at the projected 48, the last two years alone will account for 82 of 228 total reports — over a third of a decade's incidents in the final two years.

BC's lawyer population vs. report growth

BC's licensed lawyer population grew from roughly 11,000 in 2016 to approximately 13,500 by 2025 — about a 20% increase. Rule 10-4 reports grew 750% over the same period.

Even accounting for improved reporting compliance, the gap between population growth and incident growth is enormous. You don't get an 8.5× increase in reports from a 20% increase in lawyers simply because more people know the rule. The attacks are increasing.

What's likely driving the numbers

The Law Society hasn't provided a breakdown by incident type for the post-2020 data (we've asked). But based on what we see in our work with BC law firms and broader industry data, the likely drivers are:

1. Business email compromise (BEC) — The single most common attack vector for professional services firms. A compromised email account can expose client communications, trust account details, and wire transfer instructions. The NetDiligence 2025 Cyber Claims Study found BEC was the second-leading cause of loss, with 2024 seeing the highest number of BEC claims on record. The average incident cost: $98K.
2. Ransomware — While less frequent than BEC, ransomware is far more destructive. The average SMB ransomware incident costs $631K. For a law firm with client files on a locked server, the pressure to pay is immense — and the Law Society doesn't look kindly on firms that can't protect client data.
3. Remote/hybrid work exposure — Firms that rushed to remote work in 2020–2021 without proper security hardening (MFA on all accounts, endpoint detection, secure remote access) created attack surfaces that are still being exploited years later.
4. Supply chain / third-party breaches — The 2025 NetDiligence study found third-party incidents at SMBs jumped to an average of $1.4M in 2024, up from $424K in 2020. Law firms rely on numerous third-party platforms — practice management, document management, accounting — any of which can be the entry point.

Two caveats the data can't resolve

What this means for BC law firms

If you run a law firm in British Columbia, these numbers should change how you think about cybersecurity. The question is no longer could this happen to us? — it's when it does, will we be ready?

1. Rule 10-4 is not a theoretical obligation

Forty firms have already filed this year. The Law Society expects compliance, and reporting is mandatory. If your firm suffers a breach and doesn't file, you're risking a separate professional conduct issue on top of the breach itself. Make sure every lawyer in your firm knows what Rule 10-4 requires and who to call.

2. The controls that prevent these reports are known and deployable

The majority of law firm cyber incidents trace back to the same root causes: compromised email accounts, ransomware from unpatched systems, and wire fraud via business email compromise. The preventive controls — multi-factor authentication on every account, endpoint detection and response, immutable backups, and verbal call-back verification for wire transfers — are not exotic. They're standard. We cover all of these in our Cyber Insurance Readiness Kit for Canadian Law Firms.

3. Your cyber insurer is watching these numbers too

Underwriters price premiums based on claims data and risk trends. BC is showing a sharply rising incident curve. Firms that can't demonstrate strong controls will face higher premiums, lower sublimits, or declined applications. Firms that can show MFA on all accounts, tested backups, and documented incident response will be in a fundamentally different negotiating position.

4. The LSBC cloud computing checklist is the floor, not the ceiling

The Law Society's cloud computing checklist sets out baseline technology requirements for BC firms. But the firms in these reports were presumably aware of those requirements — and still got hacked. Compliance with the checklist is necessary but not sufficient. Active security monitoring, tested incident response, and continuous configuration management are what actually reduce incident risk.

The bottom line

220 reports. An 8.5× increase. A record year that isn't over. A growth rate that hasn't slowed in a decade.

The Law Society's own data shows cyber incidents at BC law firms are accelerating — not stabilizing. Every BC law firm should treat this as an operational risk that requires active management, not a compliance line item that gets reviewed once a year.

If your firm hasn't assessed its security posture against the threats driving these numbers, now is the time. Not after you become report 221.

Source: Law Society of British Columbia, Rule 10-4 report data. Figures for 2016–2020 were provided in earlier Law Society replies (March 2020, September 2021). Figures for 2021–2026 are from the Law Society’s current reply. 2026 data is current to October 30, 2026.