In 2026, some of the best-resourced law firms in the world disclosed data breaches one after another. The pattern behind them matters more than the names: in most cases the attackers did not break any technology. They persuaded a person.
What happened
On 30 March 2026, data from Jones Day appeared on a leak site linked to the extortion group Silent Ransom Group. The firm described a phishing incident affecting "a limited number of dated files for 10 clients".
In late May, Herbert Smith Freehills Kramer reported unauthorised access to a "limited portion" of its systems in a filing with the Vermont Attorney General. The exposed data included Social Security numbers, government ID numbers and health records. The firm said the incident sat in part of its US IT environment.
Over the summer the list kept growing. Goodwin Procter disclosed a "limited data security incident" on 7 August. On 14 August, an unauthorised party gained access to a Quinn Emanuel user account "through social engineering" and reached stored files. In early September, Holland & Knight, Katten and Greenberg Traurig confirmed incidents. Greenberg Traurig told Reuters that a limited number of documents had been posted on the dark web and that its firm systems were not compromised.
The numbers confirm the trend. According to Reuters, the law firm BakerHostetler handled nearly 60 cyber incidents involving law firms in 2025, almost double its 2024 caseload. Across more than 1,250 incidents in all industries, phishing was the cause in 30% of cases.
How the attacks worked
The firms have published little technical detail, but the descriptions they did give point the same way. Phishing at Jones Day. Social engineering at Quinn Emanuel. Social engineering that gave remote access to a firm computer at Holland & Knight, according to reporting on the incident. One deceived employee, one compromised account, and then access to whatever that account could reach.
Several of these incidents have been linked by threat intelligence researchers to Silent Ransom Group, which phones staff while posing as IT support. Most of the firms themselves have not confirmed who was behind the attacks.
Why it matters for UK firms
Most of these firms are US-headquartered, but the risk is not American. The UK's National Cyber Security Centre has reported that roughly three quarters of the country's top 100 law firms have been affected by cyber attacks. The regulatory consequences are also concrete: in 2025 the ICO fined DPP Law £60,000 after stolen client data appeared on the dark web, noting that the firm took 43 days to report a breach that should have been reported within 72 hours.
For a smaller firm, the issue is proportion. A single compromised mailbox can expose years of privileged correspondence, and stolen documents often surface on the dark web before anyone at the firm knows they are gone.
What to do now
- Monitor for your own data. Watch leak sites, breach dumps and credential markets for your domains, staff email addresses and client names, so you learn about exposure before your clients do.
- Make one account worth less. Limit what each user can access, separate matter files by need-to-know, and remove standing access to archives.
- Use phishing-resistant MFA such as passkeys or hardware keys for email, document management and remote access.
- Agree how IT will contact staff and how staff can verify it. Train people to hang up and call back on a known number.
- Prepare the 72-hour clock. Have an incident plan that names who decides on ICO notification, who informs clients and who calls your insurer.
How Blacknote helps
Our Data Leak & Exposure Surveillance service watches for your firm's data, credentials and client information on leak sites and in breach data, and alerts you with clear next steps. If something has already happened, our incident response team takes charge of triage, containment and notifications with your lawyers.
Sources
- Decrypt: Cyberattacks on law firms nearly double as stolen documents hit the dark web (11 Sep 2026, citing Reuters)
- ABA Journal: Jones Day latest Big Law firm to fall victim to cyber phishing incident
- Cybernews: Quinn Emanuel and McDermott data breaches
- Captain Compliance: Herbert Smith Freehills Kramer, Goodwin Procter, Blank Rome and more disclose data breaches
- Law Society Gazette: Firm fined after stolen client details leaked onto dark web