Several U.S. law firms have disclosed separate data-security incidents, but the available reports do not establish one coordinated attack or a single shared list of affected people. Some notices say Social Security numbers may have been involved; the data and number of people differ by incident. If you received a notice, use that firm’s letter to confirm what information about you was involved and what steps are available.
What the reports establish—and what they do not
The incidents below involve different firms, timelines and disclosures. A mention in a roundup does not mean every firm exposed Social Security numbers, and a state notice listing does not by itself identify the data involved. There is no validated nationwide total of recent law-firm incidents or affected people in the available sources.
As an Amazon Associate I earn from qualifying purchases.
Cybernews reported incidents involving Holland & Knight and Squire Patton Boggs, alongside separate incidents or litigation involving Quinn Emanuel, McDermott, Greenberg Traurig and Nelson Mullins. Its report does not establish that those matters were part of a coordinated breach. California’s Attorney General notice list separately records recent filings for Greenberg Traurig and Seyfarth Shaw.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat is known about each law-firm incident
Dates and counts below refer to the specific reporting or notice cited. “Not stated” means the cited source does not establish the detail; it does not mean the detail is necessarily unknown to the firm.
#1 Best Overall
| Firm and source | Incident and notice timing | What the source says about access and data | Affected people and response |
|---|---|---|---|
| Holland & Knight, as reported by Cybernews | Incident date not stated in the report. | The firm said social engineering gave an attacker remote access to a firm computer. A small number of files contained information including Social Security numbers. Whether files were downloaded or posted is not stated. | The firm said it promptly notified 14 clients. Cybernews said the full affected-person count was unclear; 14 notified clients should not be read as the incident’s total. |
| Squire Patton Boggs, as reported by Cybernews | Incident and notice dates not stated in the report. | The firm said an unauthorized third party obtained a limited set of information. Specific data categories are not stated here. | Cybernews’s account of Vermont’s regulatory disclosure says two Vermont residents were affected. That figure is not a count for other jurisdictions or incidents. |
| Pillsbury, firm notice | An unauthorized actor downloaded a subset of accessed documents on April 29–30, 2025. The notice was posted July 13, 2026. | Information varied by person and could include Social Security or other government identifiers, bank account number, passport number, birth date, medical information or health-insurance identifiers. | The firm says individual notification is complete. Impacted individuals were offered 24 months of Equifax credit monitoring and identity-theft protection. |
| Midkiff, Muncie & Ross (MMR), firm notice | The firm detected unusual activity on December 8, 2025, and later determined an unknown actor may have acquired files. It confirmed the impact scope on August 18, 2026; its notice is dated September 10, 2026. | Information potentially involved varied by person and could include Social Security numbers, identity documents, financial details, health-insurance information and medical information. The notice says files may have been acquired; it does not establish that every listed category was involved for every person. | Eligible people were offered enrollment in complimentary IDX identity-protection services. A total affected-person count is not stated here. |
| Greenberg Traurig, California Attorney General list | California’s list records a reported breach date of August 26, 2026, and a submission date of October 1, 2026. | The list entry alone does not establish which data elements were exposed. Consult the linked sample notice for those details. | The list is a California notice repository, not a nationwide count. The listed entry does not provide a national affected-person total. |
| Seyfarth Shaw, California Attorney General list | California’s list records a reported breach date of August 18, 2026, and a report date of September 18, 2026. | The list entry alone does not establish which data elements were exposed. Consult the linked sample notice for those details. | The list is a California notice repository, not a nationwide count. The listed entry does not provide a national affected-person total. |
The Cybernews roundup also mentions Quinn Emanuel, McDermott and Nelson Mullins in connection with separate incidents or litigation. The cited material here does not provide enough comparable incident details to assign data categories, dates or affected-person counts to those firms.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to respond if you received a breach letter
1. Confirm what applies to you
Start with the letter and the firm’s incident page or call center. Check which data about you may have been involved, whether you are eligible for an offered service, how to enroll, and any deadline. Categories listed in a notice may vary by person; do not assume every listed type of information applied to you.
2. Review accounts and obtain your credit reports
Check bank, credit-card and other financial accounts for unfamiliar activity, and obtain your credit reports through AnnualCreditReport.com. Follow the contact and dispute instructions from the relevant financial institution or credit bureau if you find suspicious activity.
3. Consider a free credit freeze or fraud alert
A credit freeze can make it harder for someone else to open new credit in your name. Pillsbury’s July 13, 2026 notice says a freeze is free and must be requested separately from each nationwide credit bureau. Its notice also describes a one-year fraud alert that can be renewed. MMR’s notice likewise directs readers to free reports, fraud alerts and security freezes, and links to FTC identity-theft guidance.
4. Treat monitoring as an option, not a guarantee
Use an included monitoring or identity-protection offer only after checking eligibility and enrollment terms in your notice. Monitoring does not prevent identity theft, and possible exposure does not prove that anyone has misused your information. The notices described here include complimentary offers for eligible people; a paid service is not required to request a free credit freeze or fraud alert.
Quick Recap
How to interpret breach notices and state lists
- A notice describes a particular incident. Do not combine separate firms’ timelines, affected groups or data categories into one breach.
- “May have been involved” is not proof of misuse. It describes possible exposure; the notice may not establish that every listed data type applied to every person.
- A notification count is not always the total affected population. Cybernews attributes the figure of 14 notified clients to Holland & Knight’s statement, while its account of the Squire Patton Boggs regulatory disclosure identifies two Vermont residents. These are separate, limited figures—not a combined total.
- State lists have jurisdictional limits. California’s Attorney General says its directory contains sample notices received under California law, including notices for incidents affecting more than 500 California residents. It is useful for finding filings, not as a complete national census.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
