The Uptime report

Uptime Report Research · State AG Filings · As of November 5, 2026

Law Firm Data Breaches 2026: 82 Firms in State AG Filings, a Rise Led by LLP Names, With 9 Notices Naming Social Engineering

Law firm data breaches 2026, as of November 5, 2026: six state breach lists show 82 law firms filing 185 notices since January, and the four lists with a 2025 file rose 15% to 29% over the same window, depending on how LLP names are counted. The median stated total is 2,408 people. Social engineering is named in 9 firms’ notices. A listing is a notice, not a finding of fault.

82law firms on six state lists, Jan 1 to Nov. 5
58 to 75firms, same window and four lists, 2025 to 2026, while all filers moved 3,888 to 3,920 notices
2,408median people affected, 58 firms stating a total
5firms stating 100,000 people or more
122.5 daysmedian breach to notice in Indiana, against 133 for all filers

The pages ranking for this search quote survey percentages from vendors or retell one filing at a time. This one starts from the regulators’ records. We matched every 2025 and 2026 notice on the California, Indiana, Massachusetts, Texas, Vermont and Washington lists against a written name rule, then read the notices and firm sites for every name that the rule could not settle. Every row below links to the list or letter it came from.

The latest law firm breach filings

Newest filing Firm List People, largest stated
Nov 3 Ritz Clark & Ben-Asher LLP Massachusetts OCABR 14
Oct 30 Troutman Pepper Locke LLP Texas AG 63,358
Oct 28 Baker & McKenzie LLP Texas AG 25,837
Oct 26 Helmick Law, PLLC d/b/a Pacific West Injury Law Massachusetts OCABR 3
Oct 15 Law Office of Barbara L Horan Massachusetts OCABR 1
Oct 14 BDG Law Group California AG 629
Oct 12 Squire Patton Boggs (US) LLP Texas AG 3,824
Oct 9 Womble Bond Dickinson (US) LLP Indiana AG 4,421

How to read a row. A row means a firm filed a breach notice with a state regulator. It is not a finding that the firm did anything wrong, and we state only what the filing says. People counts come from the filer and can be revised.

How big are law firm data breaches in 2026?

Most are small and a few are very large. Of the 58 firms stating a nationwide or total figure, 18 state fewer than 1,000 people and 5 state 100,000 or more; the median is 2,408. A further 21 firms appear only with a count of one state’s residents, and those figures are floors. 3 list no count at all.

Under 100: 3 firms with a stated total, 21 with only a state resident count. Perkins Coie LLP, Law Offices of Robert P. Gaffney, Meitus Strohm LLP, Taft Stettinius & Hollister LLP, The Law Office of David Rocheford, Ritz Clark & Ben-Asher LLP24Under 100100 to 999: 15 firms with a stated total, 0 with only a state resident count. The Reecer Law Firm PLLC, Martin & Cukjati, LLP, Holland & Knight LLP, St Peter O’Brien Law Office PC & Relevant Clients, BDG Law Group, Law Offices of David A. Helfand PA15100 to 9991,000 to 9,999: 22 firms with a stated total, 0 with only a state resident count. Law Offices of Alan C. Cohen & Associates LLC, The Law Offices of Rakesh Mehrotra, Bahrie Law, PLLC, Riddle & Butts, LLP, Rusin Law Ltd, Womble Bond Dickinson (US) LLP221,000 to 9,99910,000 to 99,999: 13 firms with a stated total, 0 with only a state resident count. Troutman Pepper Locke LLP, Blank Rome LLP, Seyfarth Shaw LLP, Fox Rothschild LLP, Tarter Krinsky & Drogin LLP, Berger & Williams, LLP1310,000 to 99,999100,000 or more: 5 firms with a stated total, 0 with only a state resident count. Wilmer Cutler Pickering Hale and Dorr LLP, Sheppard, Mullin, Richter & Hampton LLP, Fried, Frank, Harris, Shriver & Jacobson LLP, Greenberg Traurig, LLP, Rodenburg Law Firm5100,000 or morePeople affected, largest figure stated on any list. Dark: nationwide or total figure stated. Light: only one state resident count listed.

People affected is a measure of data held, not headcount, so it is the only size lens these lists offer. It tracks firm form only loosely. The 35 LLP names stating a total have a median of 3,824 people, while the 23 law offices, law groups and P.C. or PLLC names have a median of 2,000.

Firm form, from the name Firms Stating a total Median total Largest stated
LLP partnership 51 35 3,824 911,658
Law office or solo practice 14 10 2,400 29,008
Law firm (P.C., PLLC, LLC, other) 12 10 2,026 119,895
Law group or center 5 3 1,213 19,596

The ten largest stated totals

Lists disagree, and we show the figures rather than pick a winner. Wilmer Cutler Pickering Hale and Dorr LLP stated 911,658 to Texas and 33,156 to Indiana, filed 42 days apart; its Washington record alone lists 17,253 residents. The largest figure sets the rank.

# Firm Largest stated Totals by list First notice Cause as stated
1 Wilmer Cutler Pickering Hale and Dorr LLP 911,658 IN 33,156; TX 911,658 Jul 10 personnel provided information to a third party who misrepresented their identity
2 Sheppard, Mullin, Richter & Hampton LLP 204,001 IN 204,001; TX 204,001 Oct 2 a single attorney was the victim of a social engineering event
3 Fried, Frank, Harris, Shriver & Jacobson LLP 179,613 IN 46,602; TX 179,613 Jan 30 Washington AG: unauthorized access
4 Greenberg Traurig, LLP 150,000 IN 150,000; TX 150,000 Sep 8 Not stated in what we read
5 Rodenburg Law Firm 119,895 IN 119,895; TX 81,307 Apr 21 unauthorized access into its environment
6 Troutman Pepper Locke LLP 63,358 IN 63,358; TX 63,358 Oct 28 an employee was targeted by a social engineering attack
7 Blank Rome LLP 57,577 IN 57,577; TX 57,554 Jun 26 Not stated in what we read
8 Seyfarth Shaw LLP 56,755 IN 56,755; TX 56,755 Sep 18 a small number of documents sent by email to an unauthorized recipient
9 Fox Rothschild LLP 54,244 IN 54,244; TX 54,244 Jul 16 the target of a social engineering attack, commonly referred to as vishing
10 Tarter Krinsky & Drogin LLP 49,374 TX 49,374 Jun 5 suspicious activity in its environment

How many law firm breaches were reported each month?

June was the peak in the first-notice count with 14 firms, followed by October with 11. By people, July dominates because of one filing. The month a firm appears tells you when it filed, not when it was breached: 31 of the 62 firms with a stated breach date describe a breach that began before 2026.

2025 2026 · firms by first notice on the four lists with a 2025 file

Jan: 4 firms in 2025, 6 in 20266JanFeb: 4 firms in 2025, 7 in 20267FebMar: 5 firms in 2025, 7 in 20267MarApr: 10 firms in 2025, 5 in 20265AprMay: 7 firms in 2025, 9 in 20269MayJun: 5 firms in 2025, 13 in 202613JunJul: 9 firms in 2025, 6 in 20266JulAug: 5 firms in 2025, 6 in 20266AugSep: 5 firms in 2025, 5 in 20265SepOct: 4 firms in 2025, 11 in 202611Oct

Month Firms, first notice (six lists) Notices (six lists) People, largest stated per firm Firms 2025 (four lists) Firms 2026 (four lists)
Jan 7 17 213,483 4 6
Feb 7 10 51,952 4 7
Mar 7 14 16,647 5 7
Apr 7 12 130,665 10 5
May 9 18 40,727 7 9
Jun 14 30 145,524 5 13
Jul 7 24 974,019 9 6
Aug 7 13 31,306 5 6
Sep 5 12 206,915 5 5
Oct 11 33 306,209 4 11
Nov* 1 2 14

*November through Nov. 5 only. People column sums the largest figure each firm stated and places it in the month of first notice; one person can appear in several firms’ notices, so treat the sum as a rough scale.

Are law firm breaches up on 2025?

On these lists, yes, and the rise sits in LLP-named firms. Comparing January 1 to October 31 (October 13 for Washington, where the dataset stops), firms we confirmed went from 58 to 75, up 29%. Across all organizations those lists went from 3,888 notices to 3,920. Law firms’ share of notices rose on all four lists.

List All notices 2025 All notices 2026 Law firm notices 2025 Law firm notices 2026 Share 2025 Share 2026
California AG 464 491 6 22 1.3% 4.5%
Indiana AG 1,399 1,359 37 54 2.6% 4.0%
Massachusetts OCABR 1,853 1,910 41 57 2.2% 3.0%
Washington AG (to Oct 13) 172 160 2 4 1.2% 2.5%

That figure needs three checks, and they do not all agree. Names with an explicit legal term, the small practices and law groups, were flat: 27 firms to 26. The unread rule, with every LLP name included, went from 80 to 94, up 18%. Adding back only the LLP names we could not confirm gives 73 to 84, up 15%. We could confirm fewer 2025 names than 2026 names, which lifts the 29% figure, so treat 15% to 29% as the range. What every version shows is growth among LLP-named firms and none among the rest. Texas and Vermont stay out of this comparison because Texas lists only about 12 months and Vermont’s older document titles drop suffixes such as LLP.

What is causing them?

Among the 32 firms with a stated cause, the most common named method is a person being deceived. Massachusetts law keeps many letters silent on the nature of the incident, so 50 of 82 firms stay uncoded. Here is every firm whose notice names social engineering, phishing or impersonation, with the dates they give falling between April and August 2026.

Network or systems access, method not named: 13 firmsNetwork or systems access, method not named13Social engineering, phishing or impersonation named: 9 firmsSocial engineering, phishing or impersonation named9One user, account or set of documents, method not named: 5 firmsOne user, account or set of documents, method not named5Ransomware named: 3 firmsRansomware named3Email account access named: 2 firmsEmail account access named2
  • Hahn Loeser & Parks LLP: “On April 28, 2026, we learned that an unauthorized third party, via a phishing attempt, was able to access an employee’s computer for a short time.” First state filing Jun 16.
  • Wilmer Cutler Pickering Hale and Dorr LLP: “On May 8, 2026, one of our personnel mistakenly provided information to an unauthorized third party who misrepresented their identity.” First state filing Jul 10.
  • Fox Rothschild LLP: “on May 21, 2026 the employee was the target of a social engineering attack, commonly referred to as vishing, and certain files were copied and taken.” First state filing Jul 16.
  • The Chartwell Law Offices, LLP: “On April 9, 2026, Chartwell experienced an isolated social engineering incident involving unauthorized access to a limited number of documents.” First state filing Aug 7.
  • Fragomen, Del Rey, Bernsen & Loewy, LLP: “On May 5, 2026, Fragomen learned that an unauthorized third party gained remote access to a single user account, which we determined was part of a social engineering campaign.” First state filing Oct 2.
  • Sheppard, Mullin, Richter & Hampton LLP: “On August 31, 2026, a single Sheppard attorney was the victim of a sophisticated social engineering event which resulted in the unauthorized disclosure of certain documents to an unknown third-party.” First state filing Oct 2.
  • Womble Bond Dickinson (US) LLP: “Beginning August 20, 2026, one of our personnel mistakenly provided information to an unauthorized third party who misrepresented their identity.” First state filing Oct 9.
  • Baker & McKenzie LLP: “On August 14 and 17, 2026, a threat actor socially engineered two of our users and obtained a limited number of files.” First state filing Oct 27.
  • Troutman Pepper Locke LLP: “On August 7, 2026, a Troutman employee was targeted by a social engineering attack and interacted with communications that appeared legitimate but were not.” First state filing Oct 28.

The wording repeats: one person or account, and a limited or named set of files. Our phishing statistics cover the wider trend. This matches a warning the FBI aimed at this sector. Its May 23, 2025 notice on Silent Ransom Group says the group has “consistently targeted US-based law firms” since spring 2023, using IT-themed calls and then, as of April 2025, sending a person to the office to insert a storage device. None of the notices above names an attacker, and we do not connect any firm to that group. 3 firms name ransomware, and one public company shows what that does to clients: Navient told the SEC on July 2 that ransomware at an unnamed outside law firm exposed borrower data, and it judged the incident material. Our ransomware statistics for 2026 track the leak-site side.

How long do law firms take to send notice?

Quicker than other filers on all five clocks, though the gap is small in Indiana and on the Texas discovery clock, and notice still comes months after the breach. Each dot below is one firm’s notice. The red bar is the law firm median and the dark triangle is the median for every organization on that list.

1 week30 days90 days6 months1 year2 yearsIndiana: breach to consumer notice (n = 54)Bahrie Law PLLC: 126 daysBaker & McKenzie LLP: 74 daysBDG Law Group: 273 daysBeasley & Gilkison LLP: 152 daysBerger & Williams LLP: 452 daysBlake Jones Law Firm LLC: 345 daysBlank Rome LLP: 36 daysCardone Law Firm: 211 daysCharlie Condon Law Firm LLC: 214 daysDubroff, Easley, & Lovell LLP: 204 daysDue Doyle Fanning & Alderfer LLP: 296 daysFoster & Eldridge LLP: 254 daysFox Rothschild LLP: 56 daysFrasier, Frasier, & Hickman LLP: 179 daysFried, Frank, Harris, Shriver, & Jacobson LLP: 99 daysGoodwin Procter LLP: 56 daysGreenberg Traurig LLP: 13 daysHahn Loeser & Parks LLP: 62 daysHolland & Knight LLP: 55 daysJohnson, Webbert, & Beard LLP: 234 daysLaw Offices of Alan M Cohen & Associates LLC: 203 daysLaw Offices of David A. Helfand PA: 94 daysLaw Offices of James Scott Farrin: 172 daysLaw Offices of Mark S. Martinez: 333 daysLaw Offices of Robert P. Gaffney: 461 daysMarsicovetere & Levine Law Group PC: 423 daysMcCoyd, Parkas, & Ronan LLP: 29 daysMcDermott Will & Schulte LLP: 113 daysMcNeelyLaw LLP and Subro Solution Inc: 46 daysMeitus Strohm LLP: 7 daysO’Leary-Guth Law Office SC: 59 daysOrenstein Law PLLC dba Atlas Orange: 146 daysPearlman, Brown, & Wax LLP: 74 daysPease Mountain Law PLLC: 303 daysPerkins Coie LLP: 128 daysPorter Wright Morris & Arthur LLP: 93 daysRiddell Law Group: 119 daysRiddle & Butts LLP: 70 daysRodenburg Law Firm: 238 daysRusin Law Ltd: 231 daysSeyfarth Shaw LLP: 31 daysSheppard, Mullin, Richter & Hampton LLP: 32 daysSingleton Schreiber LLP: 97 daysSquire Patton Boggs (US) LLP: 49 daysSt Peter O’Brien Law Office PC & Relevant Clients: 216 daysThe Law Offices of Rakesh Mehrotra: 66 daysTroutman Pepper Locke LLP: 83 daysVan Ness Feldman LLP: 167 daysWiley Rein LLP: 163 daysWiley Rein LLP: 597 daysWilmer Cutler Pickering Hale & Dorr LLP: 63 daysWindels Marx Lane & Mittendorf LLP: 200 daysWisner Baum LLP: 107 daysWomble Bond Dickinson (US) LLP: 50 daysLaw firm median 122.5 daysAll organizations on this list, median 133 daysCalifornia: breach to AG posting (n = 21)Troutman Pepper Locke LLP: 82 daysBaker & McKenzie LLP: 74 daysBDG Law Group: 398 daysSheppard, Mullin, Richter & Hampton LLP: 32 daysFragomen, Del Rey, Bernsen & Loewy, LLP: 151 daysGreenberg Traurig, LLP (“GT”): 36 daysSeyfarth Shaw LLP: 31 daysTarter Krinsky & Drogin LLP: 371 daysGreenberg Traurig, LLP (“GT”): 14 daysFox Rothschild LLP: 56 daysWilmer Cutler Pickering Hale and Dorr LLP: 63 daysRodenburg Law Firm: 310 daysBlank Rome LLP: 36 daysHausfeld LLP: 518 daysBerger & Williams, LLP: 453 daysDubroff, Easley, & Lovell, LLP: 204 daysFried, Frank, Harris, Shriver & Jacobson LLP: 134 daysM&Y Personal Injury Lawyers: 97 daysFried, Frank, Harris, Shriver & Jacobson LLP: 99 daysWisner Baum LLP: 107 daysBridgewater Law Group, APC: 16 daysLaw firm median 97 daysAll organizations on this list, median 145 daysTexas: breach start to AG posting (n = 19)Troutman Pepper Locke LLP: 84 daysBaker & McKenzie LLP: 75 daysSheppard, Mullin, Richter & Hampton LLP: 36 daysFragomen, Del Rey, Bernsen & Loewy, LLP: 155 daysGreenberg Traurig, LLP (“GT”): 37 daysSeyfarth Shaw LLP: 34 daysWilmer Cutler Pickering Hale and Dorr LLP: 105 daysBahrie Law, PLLC: 137 daysThe Law Office of Douglas D. Ketterman, P.L.L.C.: 119 daysGoodwin Procter LLP: 106 daysThe Law Offices of Rakesh Mehrotra: 68 daysBlank Rome LLP: 36 daysBerger & Williams, LLP: 454 daysMartin & Cukjati, LLP: 89 daysRodenburg Law Firm: 241 daysLaw Office of Michael R. De La Paz: 29 daysFried, Frank, Harris, Shriver & Jacobson LLP: 137 daysWisner Baum LLP: 111 daysThe Reecer Law Firm PLLC: 231 daysLaw firm median 105 daysAll organizations on this list, median 154 daysTexas: discovery to AG posting (n = 23)Troutman Pepper Locke LLP: 84 daysBaker & McKenzie LLP: 21 daysSquire Patton Boggs (US) LLP: 17 daysSheppard, Mullin, Richter & Hampton LLP: 35 daysFragomen, Del Rey, Bernsen & Loewy, LLP: 154 daysGreenberg Traurig, LLP (“GT”): 37 daysSeyfarth Shaw LLP: 34 daysWilmer Cutler Pickering Hale and Dorr LLP: 57 daysBahrie Law, PLLC: 23 daysThe Law Office of Douglas D. Ketterman, P.L.L.C.: 118 daysGoodwin Procter LLP: 106 daysFox Rothschild LLP: 29 daysThe Law Offices of Rakesh Mehrotra: 32 daysBlank Rome LLP: 29 daysThe Carlson Law Firm: 153 daysTarter Krinsky & Drogin LLP: 34 daysBerger & Williams, LLP: 30 daysMartin & Cukjati, LLP: 63 daysRodenburg Law Firm: 44 daysLaw Office of Michael R. De La Paz: 29 daysFried, Frank, Harris, Shriver & Jacobson LLP: 133 daysWisner Baum LLP: 43 daysThe Reecer Law Firm PLLC: 37 daysLaw firm median 37 daysAll organizations on this list, median 41 days
Clock Law firm notices Law firm median, days All filers median, days All filers n
Indiana: breach date to consumer notice 54 122.5 133 1,359
California: breach date to AG posting 21 97 145 465
Texas: breach start to AG posting 19 105 154 494
Texas: discovery to AG posting 23 37 41 591
Washington: awareness to AG notice 4 62 99.5 160

Across firms, using the earliest stated breach date and first notice, the median is 119 days and 22 of 62 took more than six months. Texas gives both dates on 19 law firm filings: there the median runs 7 days from breach start to discovery and 37 days from discovery to the AG’s posting. We cannot tell how each filer defines discovery, so read those clocks with care. The Washington row rests on 4 notices only. We compare other sectors in how long companies take to report data breaches.

What data do law firm notices report?

Identity data sits in legal files. Massachusetts records what each notice covered, and 88% of law firm notices list Social Security numbers, against 75% across all filers. In Texas, 23 of 23 law firm filings list Social Security numbers, 13 driver’s license numbers and 12 medical information, which fits notices that say the firm held the data because of work for a client.

In the notice (Massachusetts, 2026) Law firms (58) All filers (1,923)
Social Security numbers 88% 75%
Driver licenses 40% 33%
Financial accounts 36% 37%
Medical records 19% 21%
Credit or debit cards 10% 19%

The professional duty table

A breach at a law firm carries duties on top of state statutes. This table quotes the ABA texts, with what the filings show and what an IT provider has to supply. These are model rules and advisory opinions; the opinions themselves say that rules and opinions in individual jurisdictions control.

Duty Text What the 2026 filings show What IT has to supply
Monitor for a breach Formal Opinion 483: lawyers “must employ reasonable efforts to monitor the technology and office resources connected to the internet, external data sources, and external vendors” The median firm notice came 119 days after the stated breach date. Log retention long enough to reconstruct a mailbox or remote session, and alerts on new remote access tools.
Stop the breach and restore Opinion 483: act “reasonably and promptly to stop the breach and mitigate damage”, then make “all reasonable efforts to restore computer operations” Firms in the table describe disabling one user account, resetting access or taking the network offline. A written containment runbook with named people and an out-of-band way to reach them.
Determine what occurred Opinion 483: “gather sufficient information to ensure the intrusion has been stopped” and evaluate the data lost or accessed 31 of 62 firms with a stated breach date describe a breach that began before 2026. eDiscovery-grade export of affected mailboxes and files, because the firm must review them for client data.
Notify current clients Opinion 483 under Rule 1.4: “a duty to notify” when material client confidential information is involved. Minimum disclosure: that access occurred or is reasonably suspected, and its known extent State lists record notices to individuals, not client notices. Neither duty is visible in the other’s records. Per-client data maps, so the firm can tell which clients a stolen folder touches.
Former clients Opinion 483: the Committee is “unwilling to require notice to a former client as a matter of legal ethics” absent a black letter provision, and encourages agreements on file retention Opinion 483 notes that state statutes can cover individuals irrespective of their relationship with the lawyer. Retention enforcement in the document management system: delete on schedule, and report on it.
Reasonable efforts to protect Rule 1.6(c) and Formal Opinion 477R: “particularly strong protective measures, like encryption, are warranted in some circumstances” 88% of the firms’ Massachusetts notices list Social Security numbers. Classify matters by sensitivity and apply encryption and access limits by matter, not firmwide.
Technology competence Rule 1.1, Comment 8: keep abreast of “the benefits and risks associated with relevant technology” 9 notices name social engineering. Blank Rome’s notice says it added targeted social engineering training throughout the firm. Quarterly vishing drills for attorneys and staff, since the notices name both.
Supervise vendors and staff Rule 5.3: measures “giving reasonable assurance” that nonlawyer conduct fits professional duties. Opinion 477R: conduct due diligence on vendors An MSP is one of those vendors. Expect the firm to ask. Answer security questionnaires with evidence, and put breach notice hours in the contract.
State breach statutes Opinion 483: “All fifty states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have statutory breach notification laws” The 82 firms in this report filed 185 notices across six lists; 27 filed on three or more. Keep a state notification matrix, and record residents by state at the start of any review.

What this means for MSPs

  • Callers pretend to be you. The FBI notice describes callers posing as the firm’s IT department. If you are that department, give every firm a call-back rule: no remote session and no site visit without a code the user can check against a known number. Write the rule into onboarding and rehearse it with legal assistants and partners.
  • Block what the FBI listed. The notice names Zoho Assist, Syncro, AnyDesk, Splashtop and Atera as tools to watch for, plus WinSCP or Rclone connecting to an external IP. Some are RMM tools MSPs themselves run, so allow-list your own tenant and alert on any other instance. Alert on outbound WinSCP and Rclone on every endpoint.
  • Size your review to one mailbox and one laptop. 14 of 32 firms with a stated cause describe one person, one account or a small set of documents, yet stated totals reach six figures. Keep per-user mailbox and file audit logs long enough to answer what that one account could reach. Opinion 483 expects the firm to find out.
  • Map data to clients, not just to users. Opinion 483 requires notice to affected clients, and notices here say the data arrived through client work. A firm that cannot tie a stolen folder to client matters ends up reviewing everything. Matter-level permissions in the document management system cut that scope.
  • Enforce retention. Opinion 483 encourages agreements on what happens to client files after a matter closes, and it notes state statutes can reach individuals irrespective of their relationship with the lawyer. Build scheduled deletion and a report that shows it ran.
  • Prepare the state matrix before you need it. 27 firms filed on three or more of these six lists, with up to 137 days between one firm’s first and last filing. Capture residents by state during review, and pre-assign who files what.
  • Expect the client’s questions. Navient’s 8-K shows a law firm’s incident can become a client’s own disclosure. Have evidence ready for outside counsel security questionnaires, including your own breach notice terms, because public clients run an SEC clock once they judge an incident material.

Every 2026 law firm notice in this report

82 firms, newest first. Click a heading to sort, or type to filter. Each list link goes to the primary record: a Massachusetts or California letter or record where one exists, otherwise the state list itself. Texas and the newer Vermont rows live in the state’s own table, so search the firm name there.

82 firms shown

Firm First notice People, largest stated Filings by list Breach type as stated Form
Ritz Clark & Ben-Asher LLP Nov 3 14 MA residents only MA Nov 3: 14 residents
VT Nov 3: 3 residents		 event in parts of its network LLP partnership
Troutman Pepper Locke LLP Oct 28 63,358 CA Oct 28: count not listed
MA Oct 28: 912 residents
VT Oct 28: 24 residents
IN Oct 29: 63,358 total, 658 residents
TX Oct 30: 63,358 total, 4,194 residents		 an employee was targeted by a social engineering attack LLP partnership
Baker & McKenzie LLP Oct 27 25,837 CA Oct 27: count not listed
IN Oct 27: 25,837 total, 53 residents
MA Oct 27: 22 residents
TX Oct 28: 25,837 total, 831 residents		 a threat actor socially engineered two of our users LLP partnership
Helmick Law, PLLC d/b/a Pacific West Injury Law Oct 26 3 MA residents only MA Oct 26: 3 residents unauthorized access to network Law firm (P.C., PLLC, LLC, other)
Law Office of Barbara L Horan Oct 15 1 MA residents only MA Oct 15: 1 residents Not stated in what we read Law office or solo practice
Womble Bond Dickinson (US) LLP Oct 9 4,421 IN Oct 9: 4,421 total, 1 residents
MA Oct 9: 1 residents		 personnel provided information to a third party who misrepresented their identity LLP partnership
Holland & Knight LLP Oct 8 760 IN Oct 8: 760 total, 132 residents
VT Oct 8: 1 residents		 Not stated in what we read LLP partnership
Squire Patton Boggs (US) LLP Oct 8 3,824 VT Oct 8: 2 residents
IN Oct 9: 3,824 total, 168 residents
MA Oct 9: 7 residents
TX Oct 12: 3,824 total, 335 residents		 Not stated in what we read LLP partnership
Schlesinger Lazetera & Auchincloss LLP Oct 7 1 MA residents only MA Oct 7: 1 residents Not stated in what we read LLP partnership
Fragomen, Del Rey, Bernsen & Loewy, LLP Oct 2 1,753 CA Oct 2: count not listed
MA Oct 2: 7 residents
VT Oct 2: 1 residents
TX Oct 6: 1,753 total, 379 residents		 remote access to a single user account, part of a social engineering campaign LLP partnership
Sheppard, Mullin, Richter & Hampton LLP Oct 2 204,001 CA Oct 2: count not listed
IN Oct 2: 204,001 total, 124 residents
MA Oct 2: 272 residents
VT Oct 2: 21 residents
TX Oct 6: 204,001 total, 2,326 residents		 a single attorney was the victim of a social engineering event LLP partnership
Due Doyle Fanning & Alderfer LLP Oct 1 2,250 IN Oct 1: 2,250 total, 1,992 residents Not stated in what we read LLP partnership
Buchalter, LLP Sep 29 1 MA residents only MA Sep 29: 1 residents limited data acquired; no evidence of network access LLP partnership
Seyfarth Shaw LLP Sep 18 56,755 CA Sep 18: count not listed
IN Sep 18: 56,755 total, 149 residents
MA Sep 18: 142 residents
TX Sep 21: 56,755 total, 305 residents		 a small number of documents sent by email to an unauthorized recipient LLP partnership
Van Ness Feldman LLP Sep 17 115 IN Sep 17: 115 total, 19 residents Not stated in what we read LLP partnership
The Law Office of David Rocheford Sep 16 44 MA residents only MA Sep 16: 44 residents Not stated in what we read Law office or solo practice
Greenberg Traurig, LLP Sep 8 150,000 IN Sep 8: 150,000 total, 134 residents
VT Sep 8: 10 residents
CA Sep 9: count not listed
MA Sep 10: 104 residents
CA Oct 1: count not listed
TX Oct 2: 150,000 total, 1,839 residents		 Not stated in what we read LLP partnership
McDermott Will & Schulte LLP Aug 28 10,905 IN Aug 28: 10,905 total, 63 residents
MA Aug 28: 1,658 residents
VT Aug 28: 15 residents		 a single user inadvertently provided documents to an unauthorized person LLP partnership
The Law Office of Douglas D. Ketterman, P.L.L.C Aug 14 2,800 TX Aug 14: 2,800 total, 2,700 residents Not stated in what we read Law office or solo practice
Frasier, Frasier, & Hickman LLP Aug 12 10,605 IN Aug 12: 10,605 total, 7 residents Not stated in what we read LLP partnership
Bergeson, LLP Aug 10 1 MA residents only MA Aug 10: 1 residents Not stated in what we read LLP partnership
The Chartwell Law Offices, LLP Aug 7 1 MA residents only MA Aug 7: 1 residents an isolated social engineering incident Law office or solo practice
Law Offices of Mark S. Martinez Aug 4 229 IN Aug 4: 229 total, 1 residents Not stated in what we read Law office or solo practice
Bahrie Law, PLLC Aug 3 6,765 IN Aug 3: 6,765 total, 32 residents
MA Aug 13: 8 residents
VT Aug 13: 3 residents
TX Aug 14: 6,765 total, 301 residents		 Not stated in what we read Law firm (P.C., PLLC, LLC, other)
Porter Wright Morris & Arthur LLP Jul 30 464 IN Jul 30: 464 total, 83 residents Not stated in what we read LLP partnership
Herbert Smith Freehills Kramer (US) LLP Jul 29 4 VT residents only VT Jul 29: 4 residents Not stated in what we read LLP partnership
Taft Stettinius & Hollister LLP Jul 29 50 MA residents only MA Jul 29: 50 residents
VT Jul 29: 16 residents		 Not stated in what we read LLP partnership
Foster & Eldridge, LLP Jul 23 451 IN Jul 23: 451 total, 1 residents
MA Jul 23: 317 residents		 Not stated in what we read LLP partnership
Fox Rothschild LLP Jul 16 54,244 WA Jul 16: 1,891 residents
CA Jul 16: count not listed
IN Jul 16: 54,244 total, 31 residents
MA Jul 16: 72 residents
VT Jul 16: 14 residents
TX Jul 17: 54,244 total, 422 residents		 the target of a social engineering attack, commonly referred to as vishing LLP partnership
Wilmer Cutler Pickering Hale and Dorr LLP Jul 10 911,658 CA Jul 10: count not listed
IN Jul 10: 33,156 total, 28,518 residents
MA Jul 10: 42 residents
VT Jul 10: 11 residents
WA Jul 15: 17,253 residents
TX Aug 21: 911,658 total, 80,528 residents		 personnel provided information to a third party who misrepresented their identity LLP partnership
The Law Offices of Rakesh Mehrotra Jul 8 7,148 IN Jul 8: 26 residents
MA Jul 9: 105 residents
VT Jul 9: 1 residents
TX Jul 10: 7,148 total, 1,029 residents		 Not stated in what we read Law office or solo practice
Blank Rome LLP Jun 26 57,577 CA Jun 26: count not listed
IN Jun 26: 57,577 total, 191 residents
MA Jun 26: 36 residents
TX Jun 26: 57,554 total, 3,002 residents		 Not stated in what we read LLP partnership
Hausfeld LLP Jun 25 Not listed CA Jun 25: count not listed suspicious activity in its computer environment LLP partnership
Beasley & Gilkison LLP Jun 23 311 IN Jun 23: 311 total, 287 residents Not stated in what we read LLP partnership
The Carlson Law Firm Jun 18 250 TX Jun 18: 250 total, 250 residents Not stated in what we read Law firm (P.C., PLLC, LLC, other)
Hahn Loeser & Parks LLP Jun 16 2,539 MA Jun 16: 2 residents
IN Jun 29: 2,539 total, 359 residents		 via a phishing attempt, able to access an employee’s computer LLP partnership
Morrison Mahoney, LLP Jun 16 5 MA residents only MA Jun 16: 5 residents Not stated in what we read LLP partnership
BDG Law Group Jun 11 629 IN Jun 11: 629 total, 1 residents
CA Oct 14: count not listed		 Not stated in what we read Law group or center
Goodwin Procter LLP Jun 11 31,727 IN Jun 11: 31,727 total, 2 residents
MA Jun 11: 5 residents
TX Jul 31: 13,805 total, 1,550 residents		 disabled the affected user account LLP partnership
Law Offices of David A. Helfand PA Jun 11 581 IN Jun 11: 581 total, 1 residents Not stated in what we read Law office or solo practice
Marsicovetere & Levine Law Group, P.C Jun 11 1,213 IN Jun 11: 1,213 total, 1 residents
MA Jun 11: 26 residents
VT Jun 11: 859 residents		 Not stated in what we read Law group or center
McCoyd, Parkas & Ronan LLP Jun 10 1,240 MA Jun 10: 29 residents
VT Jun 10: 1 residents
IN Jun 11: 1,240 total, 2 residents		 a ransomware attack on its computer network LLP partnership
Pearlman, Brown & Wax LLP Jun 9 1 IN residents only CA Jun 9: count not listed
IN Jun 9: 1 residents		 suspicious activity in network LLP partnership
Tarter Krinsky & Drogin LLP Jun 5 49,374 MA Jun 5: 963 residents
VT Jun 5: 34 residents
TX Jun 9: 49,374 total, 325 residents
CA Sep 15: count not listed		 suspicious activity in its environment LLP partnership
Perkins Coie LLP Jun 3 77 IN Jun 3: 77 total, 1 residents
MA Jun 3: 1 residents		 a third party accessed a single user’s account LLP partnership
Singleton Schreiber, LLP May 27 232 IN May 27: 232 total, 2 residents
MA Jun 1: 1 residents		 Not stated in what we read LLP partnership
Meitus Strohm LLP May 22 7 IN May 22: 7 total, 1 residents Not stated in what we read LLP partnership
Parker Lipman LLP May 20 2 MA residents only MA May 20: 2 residents Not stated in what we read LLP partnership
Pease Mountain Law, PLLC May 20 1,013 IN May 20: 1,013 total, 2 residents
MA May 20: 20 residents
VT May 20: 785 residents		 Not stated in what we read Law firm (P.C., PLLC, LLC, other)
Charlie Condon Law Firm, LLC May 8 2,975 IN May 8: 2,975 total, 8 residents
MA May 9: 12 residents		 Not stated in what we read Law firm (P.C., PLLC, LLC, other)
Johnson, Webbert, & Beard LLP May 7 1,418 IN May 7: 1,418 total, 3 residents
MA May 7: 28 residents
VT May 7: 13 residents		 unauthorized access to network LLP partnership
Berger & Williams, LLP May 4 34,153 IN May 4: 34,153 total, 28 residents
CA May 5: count not listed
MA May 5: 26 residents
TX May 6: 34,153 total, 312 residents		 Not stated in what we read LLP partnership
Martin & Cukjati, LLP May 4 925 MA May 4: 1 residents
TX May 5: 925 total, 897 residents		 Not stated in what we read LLP partnership
Wade Clark Mulcahy LLP May 1 2 MA residents only MA May 1: 2 residents Not stated in what we read LLP partnership
Rutan & Tucker, LLP Apr 24 1 MA residents only MA Apr 24: 1 residents Not stated in what we read LLP partnership
St Peter O’Brien Law Office PC & Relevant Clients Apr 23 747 IN Apr 23: 747 total, 3 residents Not stated in what we read Law office or solo practice
Robinette Legal Group, PLLC Apr 22 1 MA residents only MA Apr 22: 1 residents Not stated in what we read Law group or center
Rodenburg Law Firm Apr 21 119,895 IN Apr 21: 119,895 total, 231 residents
MA Apr 24: 37 residents
TX Apr 24: 81,307 total, 606 residents
VT Apr 24: 11 residents
CA Jul 2: count not listed		 unauthorized access into its environment Law firm (P.C., PLLC, LLC, other)
Law Offices of Alan C. Cohen & Associates LLC Apr 17 8,021 MA Apr 17: 6,808 residents
IN Apr 22: 8,021 total, 6 residents
VT Apr 22: 10 residents		 Not stated in what we read Law office or solo practice
Law Office of Michael R. De La Paz Apr 13 2,000 TX Apr 13: 2,000 total, 2,000 residents Not stated in what we read Law office or solo practice
Imblum Law Offices, PC Apr 2 Not listed VT Apr 2: count not listed a ransomware attack Law office or solo practice
Windels Marx Lane & Mittendorf LLP Mar 30 1 IN residents only IN Mar 30: 1 residents Not stated in what we read LLP partnership
Dubroff, Easley, & Lovell, LLP Mar 25 2,277 CA Mar 25: count not listed
IN Mar 25: 2,277 total, 1 residents
MA Mar 25: 10 residents		 access to firm systems LLP partnership
McNeelyLaw LLP and Subro Solution Inc Mar 24 100 IN Mar 24: 100 total, 96 residents Not stated in what we read LLP partnership
McElroy, Deutsch, Mulvaney & Carpenter LLP Mar 12 2 MA residents only MA Mar 12: 2 residents Not stated in what we read LLP partnership
Riddle & Butts, LLP Mar 10 6,673 IN Mar 10: 6,673 total, 7 residents
MA Mar 10: 3 residents		 Not stated in what we read LLP partnership
Rusin Law Ltd Mar 9 6,473 IN Mar 9: 6,473 total, 22 residents Not stated in what we read Law firm (P.C., PLLC, LLC, other)
Cardone Law Firm Mar 6 1,121 IN Mar 6: 1,121 total, 1 residents Not stated in what we read Law firm (P.C., PLLC, LLC, other)
Law Offices of James Scott Farrin Feb 27 29,008 IN Feb 27: 29,008 total, 20 residents
MA Mar 23: 20 residents		 suspicious activity on its network Law office or solo practice
M&Y Personal Injury Lawyers Feb 27 4 MA residents only CA Feb 27: count not listed
MA Feb 27: 4 residents		 suspicious activity on a records server Law firm (P.C., PLLC, LLC, other)
Wiley Rein LLP Feb 26 247 IN Feb 26: 120 total, 33 residents
MA Feb 26: 2 residents
IN Mar 11: 247 total, 6 residents		 Not stated in what we read LLP partnership
Law Offices of Robert P. Gaffney Feb 23 20 IN Feb 23: 20 total, 1 residents Not stated in what we read Law office or solo practice
Morrison Cohen, LLP Feb 16 1 MA residents only MA Feb 16: 1 residents unauthorized access to network LLP partnership
Riddell Law Group Feb 12 19,596 IN Feb 12: 19,596 total, 223 residents
MA Feb 20: 366 residents		 suspicious activity in network Law group or center
O’Leary-Guth Law Office, S.C Feb 5 3,076 IN Feb 5: 3,076 total, 18 residents
MA Jun 22: 7 residents
VT Jun 22: 3 residents		 Not stated in what we read Law office or solo practice
Fried, Frank, Harris, Shriver & Jacobson LLP Jan 30 179,613 WA Jan 30: 2,106 residents
CA Jan 30: count not listed
IN Jan 30: 46,602 total, 3,468 residents
MA Jan 31: 1,391 residents
CA Mar 6: count not listed
TX Mar 9: 179,613 total, 16,724 residents		 Washington AG: unauthorized access LLP partnership
Orenstein Law PLLC d/b/a Atlas Orange Jan 28 1,935 IN Jan 28: 1,935 total, 2 residents
VT Jan 28: count not listed
MA Jan 29: 3 residents		 access to employee email accounts Law firm (P.C., PLLC, LLC, other)
Blake Jones Law Firm LLC Jan 27 2,117 IN Jan 27: 2,117 total, 2 residents
MA Jan 27: 1 residents		 Not stated in what we read Law firm (P.C., PLLC, LLC, other)
The Reecer Law Firm PLLC Jan 27 994 TX Jan 27: 994 total, 897 residents Not stated in what we read Law firm (P.C., PLLC, LLC, other)
Wisner Baum LLP Jan 23 28,823 WA Jan 23: 717 residents
CA Jan 23: count not listed
IN Jan 23: 16,922 total, 270 residents
MA Jan 23: 258 residents
TX Jan 27: 28,823 total, 3,154 residents		 Washington AG: ransomware LLP partnership
Bieser Greer & Landis, LLP Jan 13 1 MA residents only MA Jan 13: 1 residents access to email accounts LLP partnership
Bridgewater Law Group, APC Jan 8 Not listed CA Jan 8: count not listed Not stated in what we read Law group or center

Frequently asked questions

What are the latest cyber attacks on law firms?

The newest filings on state lists as of November 5, 2026 are Ritz Clark and Ben-Asher LLP (Nov 3), Troutman Pepper Locke LLP (Oct 30), Baker and McKenzie LLP (Oct 28), Helmick Law, PLLC d/b/a Pacific West Injury Law (Oct 26), Law Office of Barbara L Horan (Oct 15). A listing is a notice to a regulator, not a finding of fault.

How many law firm data breaches have there been in 2026?

Our count is 82 law firms and 185 notices on six state lists from January 1 to November 5, 2026. That is a floor: the name rule misses firms whose names carry no legal term, and most states publish no list. On the four lists with a 2025 file, the same window went from 58 firms to 75.

What is the largest law firm data breach of 2026?

By stated total, Wilmer Cutler Pickering Hale and Dorr LLP: 911,658 in its Texas filing, against 33,156 in its Indiana filing. The two lists disagree, and we show both. 5 firms state a total of 100,000 or more.

What causes law firm data breaches in 2026?

Among the 32 firms whose notice or Washington record states a cause, 9 name social engineering, phishing or impersonation, 13 describe network or systems access with no method, 5 one user, account or document set, 3 ransomware and 2 email account access. The other 50 state none that we could read, often because Massachusetts letters leave the nature of the incident out.

Do law firms have to tell clients about a data breach?

Under ABA Formal Opinion 483, yes for current clients when material client confidential information is involved, under Model Rule 1.4. The opinion does not require notice to former clients as an ethics matter. State breach statutes apply separately and protect individuals. Each state’s own professional rules control.

How long do law firms take to send breach notices?

In Indiana’s 2026 list the median law firm notice came 122.5 days after the breach date, against 133 days for all organizations. In California it was 97 days against 145. Law firms were somewhat quicker than the lists as a whole, not slower.

Download the data. law-firm-data-breach-notices-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

Methodology

Sources and dates. Washington AG dataset sb4j-ca4h (last notice October 13, 2026), California AG list export and record pages (to November 3), Indiana AG year-to-date PDFs for 2026 and 2025 (2026 file posted November), Massachusetts OCABR annual PDFs and monthly letter lists (to November 3), Texas AG breach report table (to November 3, about 12 months of history), Vermont AG table and notice documents (to November 4). All retrieved November 5, 2026.

Name rule. Tier 1: a name containing law firm, law office(s), law group, law center, law partners, attorney(s), esq, esquire, lawyer(s), legal group, or a word Law followed by a legal suffix. Tier 2: LLP with no such term. We exclude attorney general, district attorney, school or college of law, bar association, legal aid, legalzoom, insurance, bank, hospital and health names, names that also match our accounting rule, a list of well-known accounting and consulting partnerships, and filings marked on behalf of another party (OBO), since those can be counsel filing for a client. P.C., P.A. and PLLC alone do not count, because doctors use them too.

Reading. LLP is a weak signal: reading showed 15 LLP names were accountants and 5 were other businesses, such as an architecture practice. So a Tier 2 name counts only if a notice letter, the firm’s own homepage or a directory says it is a law firm. Across both years that was 133 LLP names. Names we could not confirm stay out of every count, and they number 11 in 2026 and 16 in 2025. Causes come from reading each available letter, plus Washington’s cause fields, and are coded only where the text states them. Some Massachusetts PDFs are scanned or garbled, and a few letters could not be read.

Precision. We drew a random sample of 40 of the 82 2026 firms (seed 20261105) and read each one’s notice, site or name: 40 of 40 are law firms, which at 95% confidence still allows an error rate up to about 7%. Before the reading step the unread rule was far less clean, which is why it is only shown as a check.

Recall is unmeasured. We cannot say how many law firm breaches this misses. Firms with no legal term in the name, such as a bare P.C., are out by design, and most states publish no list. Maine’s public database is still offline as of November 5, 2026 (AG notice), Delaware’s database shows no notice after July 11, 2025, Oregon’s site disallows robots, and Maryland, Montana and South Carolina returned 403 to our requests, so we did not use them. Two indirect signals: of Washington’s 9 2025 and 2026 rows classed as Legal by the AG itself, the rule catches 5 and misses Berman & Rabin, P.A., Kronick Moskovitz Tiedemann & Girard, Mehri & Skalet, PLLC, Mogren, Glessner & Ahrens, P.S.. And a LinkedIn post quoting Law360’s tracker put 2026 incidents at 114 as of October 7, when our list had 74 firms; we could not read that paywalled tracker to compare lists.

Counting. Firms merge across lists within a year on a normalized name and a close match for typos. A notice is one row on one list. People is the largest total stated on any list, or the largest resident count if no total is listed. Delay uses only rows with both dates and drops negative gaps. Texas dates are AG posting dates, which can trail the filing. Washington’s dataset covers notices above 500 residents, while Massachusetts lists single residents, so the lists are not equal samples.

Legal text. ABA Formal Opinion 483 returned 403 at americanbar.org, so we read a copy hosted at attorneygrievances.com and link both. Opinion 477R was read at the ABA’s dev.americanbar.org host. Model Rule text was read at americanbar.org. Reuters returned 401 and Law.com showed no article text to our script, so neither is used for any figure.

Not advice. This is a record of public filings and published ethics guidance, not legal advice. A listing does not imply fault by any firm.

Cite as:The Uptime Report. "Law Firm Data Breaches 2026: 82 Firms in State AG Filings, a Rise Led by LLP Names, With 9 Notices Naming Social Engineering." November 2026. https://theuptimereport.com/law-firm-data-breaches-2026/

References

  1. Washington Attorney General, Data Breach Notifications (data.wa.gov). Accessed November 2026.
  2. California Attorney General, Search Data Security Breaches. Accessed November 2026.
  3. Indiana Attorney General, 2026 Year-to-Date Breach Report. Accessed November 2026.
  4. Indiana Attorney General, 2025 Year-to-Date Breach Report. Accessed November 2026.
  5. Massachusetts OCABR, 2026 Data Breach Notification Report. Accessed November 2026.
  6. Massachusetts OCABR, 2025 Data Breach Notification Report. Accessed November 2026.
  7. Massachusetts OCABR, notification reports and letter lists. Accessed November 2026.
  8. Texas Attorney General, Data Security Breach Reports. Accessed November 2026.
  9. Vermont Attorney General, Security Breach Notices. Accessed November 2026.
  10. ABA Formal Opinion 483 (October 17, 2018); copy we read. Accessed November 2026.
  11. ABA Formal Opinion 477R (revised May 22, 2017). Accessed November 2026.
  12. ABA Model Rule 1.6, Rule 1.4, Rule 5.3, Rule 1.1 Comment. Accessed November 2026.
  13. FBI Private Industry Notification 20250523-001, Silent Ransom Group Targeting Law Firms. Accessed November 2026.
  14. Navient Form 8-K, Item 1.05, July 2, 2026. Accessed November 2026.
  15. Maine Attorney General, Data Security Breaches. Accessed November 2026.
  16. LinkedIn post quoting the Law360 tracker, context only. Accessed November 2026.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

2 responses to “Law Firm Data Breaches 2026: 82 Firms in State AG Filings, a Rise Led by LLP Names, With 9 Notices Naming Social Engineering”

  1. vSphere 8 End of Support: Oct 11, 2027 (333 Days Left)

    […] Law Firm Data Breaches 2026Every law firm AG notice, sized and dated […]

    Reply
  2. Data Engineer vs Data Analyst Salary: $28,500 Gap (2026)

    […] Law Firm Data Breaches 2026Every law firm AG notice, sized and dated […]

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts