The scope of each breach is only partly known. A Texas Attorney General filing shows Baker McKenzie's breach affected 831 Texans and included Social Security numbers and medical information. That filing was published October 28, 2026, but it does not give the date of the incident or the date the firm discovered it, so the timeline behind the two-month delay allegation is not established. Squire Patton Boggs notified two Vermont residents, and Social Security numbers were among the information involved. The complaints are unadjudicated, and neither firm has admitted liability.
This moves the law-firm breach issue from disclosure into litigation against large firms holding sensitive client data. Troutman Pepper Locke LLP and Baker McKenzie also reported social engineering breaches last month, according to notices to the California and Texas attorneys general, and Holland & Knight's disclosure extends a trend Reuters has tracked since September. Plaintiff firms have already started soliciting affected individuals, so more filings are likely. Attorneys should check their own firms' defenses against social engineering and confirm that breach notification timelines can be documented, since notification delay is central to these claims.