The Lawyers Who Advise You on Data Breaches Just Got Hacked Themselves

Greenberg Traurig’s data privacy and cybersecurity practice includes a team of nearly 90 lawyers and has been praised for its prowess in national and international rankings. That fact, however, has not stopped the firm from facing its own data privacy nightmares.

On Sept. 9 and Sept. 20, Greenberg was hit with proposed class actions in the U.S. District Court for the Southern District of New York over an August cyber incursion that resulted in private information being leaked to the dark web. In court documents, plaintiffs allege that the incident affected themselves and thousands of others and they accuse the firm of deploying “egregiously inadequate data security.”

However, Greenberg is hardly alone among its Big Law peers in cyberattacks. In July, both Wilmer Cutler Pickering Hale and Dorr and Blank Rome were sued over data breaches that occurred earlier this year. And a cavalcade of major firms—many, like Greenberg, with large and celebrated cybersecurity practices—has acknowledged incidents in recent months.

Firms are spending millions in response—and often finding themselves in exactly the same position as many of their data security clients. IBM, in its most recent annual report on data breach costs, said U.S. businesses now spend an average of $11.5 million to respond to data breaches, up 13% year over year. On occasion, the tab for law firms can be even higher. In one case alone, Weil Gotshal & Manges reportedly paid as much as $20 million in ransom to stop hackers from publishing sensitive client data.

And risk is rising. Indeed, at least two recent surveys show that data breach incidents have more than doubled over the last year. And in May, the FBI issued a warning that hackers from the Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC3753, are targeting law firms using social engineering techniques.

High-Value Targets

Silent Ransom/Luna Moth was behind the attack on Weil Gotshal, according to The Insurer, which covers the insurance industry. The firm made “a suppression payment” to the group after it accessed client data “without authorization” and threatened to publish the material, the publication said.

According to the FBI, Silent Ransom typically seeks rapid access to its victims’ systems, immediately exfiltrates data, and extorts money through threats of public disclosure or the sale of stolen data. “Through phone calls and phishing emails, SRG actors pose as IT support…and usually through legitimate remote access tools or by sending an individual in-person to the victim company’s location to gain physical access to computers,” the FBI’s report said. SRG has “consistently targeted” U.S.-based law firms since the spring of 2023, the agency said.

Law firms, the hackers have found, are particularly tempting targets. Baker & Hostetler, in its 2026 report on data security incidents, noted that firms hold sensitive, business-critical client data about everything from deal terms and litigation strategy to personal information like health records and social security numbers.

One law firm breach can reveal data from hundreds or even thousands of clients, which in turn, can dramatically raise the value of the information to a ransom-seeking hacker. For instance, the suppression payment made by Weil was significantly higher than the $1 million to $8 million typically demanded by victims, The Insurer said.

AI’s Impact

Artificial intelligence is also expanding the playing field for cybercriminals. They now have access to more sophisticated AI tools to conduct their operations. Last year saw a 56% spike in AI-driven attacks across industries, according to IBM.

At the same time, AI apps and models used by law firms are providing hackers with a rich array of new targets. The most expensive incidents, the IBM report said, are those involving so-called “model inversion,” where the hacker attempts to extract information from AI, and “prompt injection,” which attempts to manipulate what AI does. Those types of incidents cost the average business around $6 million, IBM said, and “expand remediation beyond technical recovery into trust and governance.”

It’s unclear whether any of the recent high-profile attacks on firms have been orchestrated via AI or have used firms’ AI systems. In most cases where law firms have confirmed cyber incidents, they have provided the briefest of accounts about what has occurred.

In a recent statement to Reuters, for instance, Greenberg Traurig acknowledged only that a small group of clients had been affected after documents were accessed and posted. The firm stopped short of calling the incident a full-on data breach, saying that its systems had not been compromised and that it continued to “operate without disruption,” Reuters said.

Facing Litigation

Fast action to contain the incident and limited disruption will likely be key planks of Greenberg’s defense against the class actions it faces in New York. The firm has not yet filed a response to the case, one of which was brought by Morgan & Morgan and the other by New York’s Arenson, Dittmar & Karban and Oakland, Calif.’s Cole & Van Note.

WilmerHale, too, has yet to respond to the class action it faces in the U.S. District Court for the District of Columbia, filed by Milberg and the Virginia-based Wise Law Firm. In a data breach notice submitted to the state of Vermont, WilmerHale said one of its personnel “mistakenly provided information to an unauthorized third party who misrepresented their identity.”

The firm said it investigated, retained forensic experts, notified law enforcement, and detected and contained the breach on the day it occurred, May 8. WilmerHale offered those affected a 24-month membership for credit monitoring and identity theft protection services through Experian.

Firms Under Siege

Aside from Greenberg, WilmerHale, and Blank Rome, Fried, Frank, Harris, Shriver & Jacobson, Wiley Rein, Eckert Seamans Cherin & Mellott, and Pillsbury Winthrop Shaw Pittman have all faced breach-related suits in the last year.

Expect more litigation to come as the roster of firms responding to breaches continues to multiply. In its data incident report last year, Baker Hostetler reported that 30 firms reported breaches. This year, “that number nearly doubled,” the firm said. At least 10 major firms were targeted between Memorial Day and Labor Day, a period Law.com called “cyber-siege summer.”

Among other firms falling prey in recent months were:

• Jones Day, which in April turned down a $13 million demand from the Silent Ransom Group.
• Goodwin Procter confirmed to Law360 that it had suffered a data breach during the spring. As the site noted, this was the firm’s “third cybersecurity incident since the start of 2021.”
• McDermott Will & Schulte reported to state authorities in August that a May 7 social engineering attack revealed information from more than 1,600 individuals.
• Herbert Smith Freehills Kramer said the firm’s U.S. IT systems were breached in May, exposing data.
• Mayer Brown told Law.com in August that it had been hacked after an employee sent documents to a third-party who “misrepresented their identity.”
• Quinn Emanuel Urquhart & Sullivan has confirmed that it was the target of an Aug. 14 social engineering attack.
• Seyfarth Shaw informed officials in Texas, California, and Massachusetts about an Aug. 18 data breach affecting more than 400 people. The firm told Reuters that a social engineering attack exposed sensitive personal information.

More firms are almost certain to join the roster.

Databreaches.net, a website that tracks hacking activity, found in April that the Silent Ransom Group had listed 38 law firms among the sites that did not pay ransom and had their confidential information leaked. “If that seems like a lot, keep in mind that those are only the ones that didn’t pay,” Databreaches.net wrote.

Client Reaction

Corporate law departments have noticed the threat to law firms. Outside counsel guidelines, engagement terms, and information security questionnaires routinely probe a firm’s cybersecurity preparedness and threat response protocols.

In an April 2026 report, Iron Mountain said that clients are increasingly instructing firms on how to manage and protect their data “either because organizations are more conscious of security risks or because they are being forced to do so by regulatory bodies.” One law firm IT provider said that questionnaires may now “assess whether your firm has documented security policies, encryption protocols, access controls, and incident response procedures that meet their internal standards.”

The Association of Corporate Counsel’s model security controls, developed in 2017, have helped share current corporate law department requirements. They call for firms to notify clients of a breach within 24 hours, maintain 24-7 access to a security contact at the firm, and provide information about an incident rapidly to allow the client time to respond. The ACC also suggests that clients demand the right to review security practices of law firms and their subcontractors. They should also have the ability to request security audits and require that firms carry cybersecurity insurance, the ACC said.

Small Firms, Big Problem

If the largest law firms are struggling with a rash of attacks, potential litigation, and heightened client scrutiny, how are smaller and midsize firms with far fewer resources coping? Smaller firms are hardly flying under hackers’ radar. Law 360 reported in June that “cyberattacks targeting law firms remained widespread in 2025, with smaller firms accounting for the majority of reported breaches.”

And unlike their large law brethren, far fewer firms are operating with security features and policies. A 2025 report by the American Bar Association found that 41% of solo practitioners and 55% of firms with fewer than 10 lawyers have budgeted for legal technology and security. That’s compared to 68% of firms with 10-49 lawyers and 90% of firms with more than 100 lawyers.

Small firms do have certain budget-friendly options. Managed services providers are increasingly offering high-level back-office support to smaller firms, and some chief information security officers are providing fractional services to fit small and midsize firm budgets. Replicating a Big Law IT department might be impossible, but smaller firms may be able to prevent or limit the impact of cyberthreats by concentrating the firm’s resources on continuing education and employee training, leveraging outside consultants, and creating strong protocols to respond when an incident does occur.

If the last year tells us anything, it’s that firms should be on guard no matter their size. With U.S. data breach costs up 13% year over year and the number of attacks on law firms doubling, there’s little reason to believe that the frequency of attacks or their financial toll have peaked.

---

David L. Brown is a legal affairs writer and consultant, who has served as head of editorial at ALM Media, editor-in-chief of The National Law Journal and Legal Times, and executive editor of The American Lawyer. He consults on thought leadership strategy and creates in-depth content for legal industry clients and works closely with Best Law Firms as senior content consultant.