Holland & Knight, one of the largest law firms in the United States with 2,200 lawyers, has disclosed a data security incident involving unauthorized access to a firm computer, joining a growing list of major US law firms reporting breaches in recent weeks. According to a report published October 9, 2026, by Law360’s Jake Maher, Holland & Knight and Squire Patton Boggs LLP were both hit with cyberattacks exposing sensitive information, based on disclosures the firms filed that week. The Holland & Knight disclosure also surfaced on the Vermont Attorney General’s security-breach notification list on October 8, 2026.
The news lands in the middle of a run of law firm breach disclosures that has stretched across 2026, pulling in firms as prominent as Sheppard Mullin Richter & Hampton, Greenberg Traurig, and WilmerHale. Taken together, the disclosures point to a pattern cybersecurity reporters and plaintiffs’ lawyers have been tracking for months: attackers are going after the law firms that hold corporate and personal data on behalf of their clients, not just the clients themselves. For a sector built on confidentiality, the optics are brutal, and the legal fallout is arriving fast.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Holland & Knight Disclosed
Per the Law360 report and the Vermont Attorney General’s filing, Holland & Knight said an attacker used social engineering to gain unauthorized remote access to a firm computer. The firm described the exposure as involving a “small number of files,” some of which contained Social Security numbers. Holland & Knight notified 14 clients following the discovery, and the Vermont Attorney General’s breach-notification list identified one Vermont resident in the filing, a figure that should not be read as a national total.
Neither the firm’s disclosure nor the available reporting specifies exactly when the intrusion occurred or the total number of people affected nationwide. Holland & Knight said its systems remained operational throughout and that client services were not disrupted, and the firm said it has contacted law enforcement. No hacking group or individual has been publicly named as responsible; the only attribution so far is the social-engineering method the firm itself described. That gap, a breach acknowledged without a named threat actor or a national tally, is becoming a recognizable feature of how law firms are disclosing these incidents in 2026, often in narrow state-by-state filings rather than a single consolidated statement.
Squire Patton Boggs Discloses a Parallel Breach
Holland & Knight was not alone in its October filing window. The same Law360 report named Squire Patton Boggs LLP as having disclosed a separate cyberattack that exposed sensitive information, based on filings submitted the same week. Squire Patton Boggs has roughly 1,500 lawyers across offices worldwide, making it one of the largest global firms to confirm an incident in this latest round. Beyond confirming that sensitive information was exposed, the available reporting does not detail Squire Patton Boggs’ specific affected-person count or the categories of data involved, and the firm has not been linked publicly to a specific intrusion method the way Holland & Knight has.
The near-simultaneous timing of the two disclosures is part of why the story is getting attention beyond the legal trade press. Cybersecurity outlet cybernews.com grouped the two firms together in its own coverage, describing “multiple major US law firms” disclosing breaches with Social Security numbers exposed. When two firms of this size file breach notices in the same news cycle, it reinforces the sense that this isn’t an isolated incident at one firm but a sector-wide exposure problem. That framing matters for how the cybersecurity industry and regulators respond going into 2027.
The Pattern: Sheppard Mullin and Greenberg Traurig
The Holland & Knight and Squire Patton Boggs disclosures extend a trend that Reuters has been documenting since September. Reuters reported on October 8, 2026, that Sheppard Mullin Richter & Hampton LLP, a Los Angeles-founded firm, was sued in a class action days after it disclosed a data breach to state attorneys general in California, Texas, and other states. The proposed class action was filed in federal court in California that same week, according to Reuters.
Weeks earlier, on September 21, 2026, Reuters reported that Greenberg Traurig LLP was facing class actions after disclosing a cyberattack to state attorneys general in California, Texas, and other states earlier that month. The pattern across both cases is nearly identical: a firm files notice with one or more state attorneys general, and a proposed class action follows within days or weeks. That turnaround time is itself notable. It suggests plaintiffs’ firms are now actively monitoring state AG breach-notification portals specifically for law firm disclosures, treating them as a ready source of litigation rather than waiting for individual client complaints to surface.
Earlier 2026 Cases: Chartwell, WilmerHale, and Peña & Bromberg
The Holland & Knight disclosure is the latest entry in a longer list that stretches back to the spring. A breach-investigation report covering Chartwell Law Offices LLP, a Pennsylvania-based national law firm, described an isolated social-engineering attack on April 9, 2026, involving unauthorized access to a limited number of documents. Chartwell filed notice with the Massachusetts Attorney General, and notification letters to affected individuals were dated August 7, 2026, roughly four months after the reported intrusion date.
Wilmer Cutler Pickering Hale & Dorr LLP, widely known as WilmerHale, faced a proposed class action after a July 10, 2026, notice identified approximately 11 Vermont residents whose names and Social Security numbers were involved in an unauthorized access incident. According to a Hoodline report on the matter, a complaint was filed July 14, 2026, in the US District Court for the District of Columbia, with a reported docket number of 1:26-cv-02470.
A notice filed with the California Attorney General’s office, cited in a breach-investigation summary, stated that Peña & Bromberg detected irregular activity within its computer network on May 7, 2026. The firm reported the incident to law enforcement and notified state regulators as required under applicable breach-notification laws. Across all of these cases, the detail that keeps repeating is the gap between when an intrusion is detected internally and when affected individuals are actually told, often a matter of months, which is itself becoming a point of scrutiny for plaintiffs’ attorneys and regulators alike.
2026 Law Firm Breach Disclosures at a Glance
The table below summarizes what has been publicly reported about each firm’s 2026 disclosure, based on the sources cited throughout this article. Figures not confirmed in the cited reporting are marked as not disclosed rather than estimated.
| Firm | Reported Incident Type | Key Date | Data Involved | Primary Source |
|---|---|---|---|---|
| Holland & Knight LLP | Social engineering, remote access | Oct. 8–9, 2026 | Social Security numbers (small number of files) | Law360, Vermont AG |
| Squire Patton Boggs LLP | Cyberattack, sensitive data exposed | Oct. 9, 2026 | Not disclosed in detail | Law360 |
| Sheppard Mullin Richter & Hampton LLP | Data breach | Oct. 8, 2026 | Not disclosed in detail | Reuters |
| Greenberg Traurig LLP | Cyberattack | Sept. 21, 2026 | Not disclosed in detail | Reuters |
| WilmerHale | Unauthorized access | July 10–14, 2026 | Names, Social Security numbers (~11 Vermont residents) | Hoodline, court filing |
| Chartwell Law Offices LLP | Social engineering | April 9, 2026 (notices Aug. 7) | Limited number of documents | Breach-investigation report |
| Peña & Bromberg | Irregular network activity | May 7, 2026 | Not disclosed in detail | California AG notice |
Why Law Firms Keep Falling to Social Engineering
Two of the confirmed 2026 cases, Holland & Knight and Chartwell Law, specifically named social engineering as the attack method. That is consistent with how security researchers have described the law firm threat landscape for years: firms are rich in sensitive data but often lean on contract and trust relationships rather than hard technical perimeters, making an employee or a help-desk process an easier target than a firewall. A convincing phone call, an urgent email that looks like it came from IT, or a spoofed vendor request can get an attacker remote access without ever touching an exploit.
Sensitive Data at Scale
Law firms sit on a concentration of exactly the kind of data that fuels identity theft and follow-on fraud: Social Security numbers, financial account details, litigation-related personal records, and corporate deal information that hasn’t yet become public. That combination is why firms show up repeatedly in breach-notification databases even when the attack method is unsophisticated. The National Institute of Standards and Technology’s Cybersecurity Framework explicitly calls out third-party and vendor risk as a core category precisely because data doesn’t need to leak from the originating company. It can leak from any professional services firm holding a copy.
A Pattern of Delayed Disclosure
The Chartwell timeline, an April intrusion followed by August notification letters, is not unusual in these filings. Forensic investigations, legal review, and coordination with law enforcement all add time between detection and disclosure. But the gap also means affected individuals often don’t learn about exposure of their Social Security numbers for months, during which fraudulent use of that data can already be underway. It is one reason the FBI’s Internet Crime Complaint Center continues to push consumers toward proactive credit monitoring rather than waiting for a breach letter to arrive.
The Regulatory Patchwork Behind These Disclosures
Every one of the 2026 disclosures referenced in this story went through a state attorney general, not a single federal clearinghouse. Holland & Knight and WilmerHale both appear on the Vermont Attorney General’s breach list; Chartwell filed with the Massachusetts Attorney General; Peña & Bromberg filed with California; Sheppard Mullin and Greenberg Traurig each notified attorneys general in California, Texas, and additional states. That is a reflection of how US breach-notification law actually works: there is no single federal breach-notification statute for law firms, so each firm must track and comply with the specific thresholds and timelines of every state where an affected resident lives.
According to legal-industry tracking cited by JD Supra, Texas has moved to tighten its own timeline, amending its law to require notification to the Texas Attorney General “as soon as practicable” and not later than 30 days after a breach is discovered. That is a meaningfully tighter window than many states allow, and it puts pressure on firms to complete forensic review and legal sign-off faster than the Chartwell-style four-month gap between detection and notice. Firms operating nationally, which includes virtually every firm named in this story, now have to engineer their incident-response process around whichever state’s deadline is shortest.
The Litigation Playbook: Disclosure to Class Action in Days
What stands out across the Sheppard Mullin, Greenberg Traurig, and WilmerHale cases is how quickly a state AG filing turns into a lawsuit. Sheppard Mullin’s breach disclosure was followed by a federal class action in California within days, according to Reuters. Greenberg Traurig faced class actions shortly after its own state AG notifications in September. WilmerHale’s case moved from a July 10 breach notice to a July 14 class-action filing in the US District Court for the District of Columbia, a four-day turnaround.
That speed points to a now-mature plaintiffs’-bar infrastructure built specifically around breach-notification monitoring. Several firms identified in a separate breach investigation tied to Quattro Business Support Services, Inc., including Cole & Van Note, Migliaccio & Rathod, Srourian Law Firm, Shamis & Gentile, Finkelstein Blankinship Frei-Pearson & Garber, Levi & Korsinsky, and Dapeer Law, are described as actively investigating potential class actions tied to breach notices rather than waiting for individual clients to come forward. For law firms, the irony is hard to miss: the same legal infrastructure many of them built for clients is now being turned on their own breach disclosures.
Legal and Litigation Status Across the 2026 Disclosures
| Firm | State AG(s) Notified | Litigation Status | Residents/Clients Identified |
|---|---|---|---|
| Holland & Knight LLP | Vermont | No lawsuit identified in available reporting | 14 clients notified; 1 Vermont resident listed |
| Squire Patton Boggs LLP | Not disclosed in detail | Not disclosed in detail | Not disclosed in detail |
| Sheppard Mullin Richter & Hampton LLP | California, Texas, others | Federal class action filed (Oct. 2026) | Not disclosed in detail |
| Greenberg Traurig LLP | California, Texas, others | Class actions filed (Sept. 2026) | Not disclosed in detail |
| WilmerHale | Vermont | Class action filed, D.C. federal court (docket 1:26-cv-02470) | ~11 Vermont residents listed |
| Chartwell Law Offices LLP | Massachusetts | Potential class action under investigation | Not disclosed in detail |
| Peña & Bromberg | California | Not disclosed in detail | Not disclosed in detail |
Historical Context: Law Firms Have Been Here Before
Law firm breaches are not a 2026 invention. According to Hunton Andrews Kurth’s privacy and cybersecurity blog, New York Attorney General Letitia James announced in 2023 that Heidell, Pittoni, Murphy & Bach LLP agreed to pay $200,000 and strengthen its cybersecurity practices to settle allegations tied to a 2021 data breach. That case set an early precedent for state attorneys general treating law firm data-security failures as an enforcement matter, not just a civil litigation risk between the firm and its clients.
What has changed since then is scale and frequency. A single enforcement action in 2023 has given way to at least seven distinct firm-level disclosures surfacing in public reporting across 2026 alone, from Peña & Bromberg’s May incident through the Holland & Knight and Squire Patton Boggs filings this week. None of the available reporting establishes a verified nationwide count of how many law firms have disclosed breaches in 2026, and no single source offers an industry-wide total, but the drumbeat of individual disclosures, each triggering its own state AG filing and often its own lawsuit, is itself the story. It mirrors a broader 2026 trend of large-scale breaches hitting organizations that hold concentrated troves of sensitive personal data, from healthcare records to financial services vendors.
Market Impact: Cyber Insurance and Vendor Risk
For corporate clients, the Holland & Knight and Squire Patton Boggs disclosures land at an uncomfortable moment. Many of the companies that retain large firms for litigation, M&A, and regulatory work have spent 2026 tightening their own third-party and vendor-risk programs, as seen in the fallout from breaches at other professional-services providers covered this year, including the EY third-party vendor-risk gap story. Outside counsel has traditionally sat outside that vendor-risk scrutiny because of privilege and confidentiality norms, but a repeated pattern of firm-level breaches makes that exemption harder to justify internally for corporate security teams.
Cyber insurers are watching the same pattern. Firms like Coalition, Chubb, and At-Bay, compared in detail in our cyber insurance market breakdown, increasingly price professional-services policies based on sector-wide loss data rather than individual firm history. A cluster of law firm disclosures within a single quarter, as has happened between September and October 2026, tends to show up in renewal pricing and underwriting questionnaires well before it shows up in any public regulatory action. IBM reported a $4.99M average breach cost in October 2026, 12% above 2025, and said AI-driven attacks were up 56%, costing $6M per incident, which gives underwriters further reason to reprice. Tabush’s October 2026 survey covered more than 230 law-firm leaders.
How Law Firm Breaches Compare to Other Sector Incidents in 2026
Law firms are far from the only regulated-data holders disclosing breaches this year. Advantest disclosed a breach roughly 233 days after a ransomware attack, as covered in our report on the Advantest disclosure timeline, and Denmark’s Technical University faced a GDPR probe after a breach exposed data belonging to 200,000 users, detailed in our coverage of the DTU breach fallout. What distinguishes the law firm cluster is the near-total absence of a single, large, headline-grabbing number. Holland & Knight’s 14 notified clients and WilmerHale’s roughly 11 Vermont residents are tiny compared to incidents affecting tens of thousands or millions of people, yet the law firm disclosures are drawing comparable attention because of what the data represents and who holds it: Social Security numbers tied to high-value corporate and individual clients, inside firms that are themselves frequently retained to defend other companies against similar breach litigation.
That contrast also shows up in how enforcement is unfolding. Nationwide, government agencies have been pushing organizations of every size to harden defenses, a push mirrored outside the US in initiatives like Japan’s order for 1,000 firms to harden cyber defenses. Meanwhile, criminal enforcement against the attackers themselves remains comparatively rare, underscored by cases like the FBI’s pursuit of suspects in the ShinyHunters employee-data hacks, where arrests took months to materialize even after breaches became public. Social-engineering-driven law firm breaches, by contrast, have so far produced no publicly named suspects at all.
What Happens Next: Predictions Through Early 2027
- More law firm disclosures are likely before year-end, given that at least seven firms have already filed in 2026 and plaintiffs’ firms are now actively monitoring state AG portals for new notices.
- Expect faster lawsuit turnaround times. The four-day gap between WilmerHale’s notice and its class action suggests plaintiffs’ counsel will keep shrinking the window between disclosure and filing.
- Corporate clients will start asking outside counsel for security attestations as part of engagement letters, mirroring the vendor-risk scrutiny already applied to other professional-services providers.
- State attorneys general, following Texas’s tightened 30-day notification requirement, are likely to push other states toward shorter disclosure windows, reducing gaps like Chartwell’s four-month delay between detection and notice.
- Cyber insurers covering law firms will likely adjust underwriting questions specifically around social-engineering defenses, given that two of the seven 2026 cases named it explicitly as the attack vector.
What Clients of Affected Firms Should Do
Anyone who receives a breach notification letter from a law firm, whether from Holland & Knight, WilmerHale, or any of the other firms named in 2026 filings, should treat it the same way as a notice from a bank or healthcare provider. The American Bar Association’s cybersecurity resources recommend placing a fraud alert or credit freeze with the major credit bureaus when Social Security numbers are confirmed exposed, enrolling in any credit-monitoring service the firm offers, and watching for unexpected account openings or tax-filing anomalies in the months following notification. Given how long some of these firms took between detecting an intrusion and sending notice, affected individuals should assume exposure may predate the letter by weeks or months and monitor accordingly.
Security teams at companies that retain any of the named firms should also request specifics directly from their outside counsel rather than relying on public filings, since state AG notices, as this story shows, often omit the total number of people affected or the precise data categories involved. Verizon’s annual Data Breach Investigations Report has repeatedly flagged social engineering and credential misuse as leading causes of breaches across professional services, making it a reasonable baseline for any security questionnaire sent to outside counsel following this latest round of disclosures.
Frequently Asked Questions
What happened in the Holland & Knight data breach?
According to Law360 and a Vermont Attorney General filing, an attacker used social engineering to gain unauthorized remote access to a Holland & Knight computer, exposing a small number of files that included Social Security numbers. The firm notified 14 clients.
How many people were affected by the Holland & Knight breach?
The firm notified 14 clients, and the Vermont Attorney General’s filing identified one Vermont resident. Available reporting does not state a total number of people affected nationwide.
Which other law firms disclosed breaches in 2026?
Squire Patton Boggs disclosed a cyberattack the same week as Holland & Knight. Earlier in 2026, Sheppard Mullin, Greenberg Traurig, WilmerHale, Chartwell Law Offices, and Peña & Bromberg all disclosed separate incidents, according to Reuters, Law360, and state attorney general filings.
What caused the Holland & Knight breach?
The firm attributed the incident to social engineering, which gave an attacker unauthorized remote access to a firm computer. No hacking group has been publicly named.
Are law firms required to disclose data breaches?
Yes. Law firms must comply with state breach-notification laws in every state where an affected individual resides, which is why firms named in this story filed separately with attorneys general in Vermont, Massachusetts, California, Texas, and other states.
What happens after a law firm discloses a breach?
In several 2026 cases, including Sheppard Mullin, Greenberg Traurig, and WilmerHale, a state attorney general disclosure was followed within days or weeks by a proposed or filed class-action lawsuit.
How does the Holland & Knight breach compare to past law firm breaches?
It follows a pattern set by earlier enforcement, including a 2023 New York Attorney General settlement with Heidell, Pittoni, Murphy & Bach LLP over a 2021 breach, but 2026 has seen a notably higher frequency of disclosures across multiple large firms within a single year.
What should clients of an affected law firm do?
Anyone notified of exposure, especially where Social Security numbers were involved, should consider a credit freeze or fraud alert, enroll in any offered credit monitoring, and monitor accounts for unusual activity in the months following notification.
