The firm has not publicly confirmed a breach. The intrusion method, timeline, and scope of affected data have not been disclosed, and no independent forensic findings have been released. The data types listed in coverage, including Social Security numbers and case files, are inferred from the kinds of records law firms hold, not confirmed. A TCPAWorld account describes a separate Nelson Mullins matter in which a threat actor allegedly accessed an employee's laptop and copied a limited set of documents. No other source corroborates that account, and the Substack author found no support for it.
The suit is one of the first tied to a new wave of breaches at large U.S. law firms. Cybernews reports that several firms were hit in recent weeks, and both incidents it describes involved social engineering. Attorneys should watch whether the firm confirms the breach and what it discloses about scope, since that will shape notification duties and damages arguments. The case may also test how courts handle claims built on unconfirmed extortion postings. Earlier suits in the same district, including the Blackbaud litigation, suggest plaintiffs in these cases often struggle to win class certification. Firms with similar exposure should review vendor access and social-engineering controls now.