Squire Patton Boggs, Baker McKenzie Sued Over Separate Cyberattacks and Delayed Breach Notices

Two proposed class actions filed November 5, 2026, accuse Squire Patton Boggs and Baker McKenzie of failing to adequately protect personal data on their systems. The plaintiffs also allege that both firms waited about two months before notifying affected people. The Baker McKenzie complaint was filed in the Northern District of Illinois, and the Squire Patton Boggs complaint in the Northern District of Ohio. The firms' accounts of their incidents differ. Baker McKenzie said a cybercriminal in August "socially engineered two of our users" to obtain a limited number of files but that "there was no independent malicious access to our system." Squire Patton Boggs disclosed in October that "an unauthorized third party" obtained "a limited set of information." Its breach notice, posted by the Vermont Attorney General on October 8, lists Social Security numbers and two affected Vermont residents. The firm, with about 1,500 lawyers, is one of the largest global firms to confirm an incident in this round. Holland & Knight disclosed a breach the same week, saying social engineering gave an attacker remote access to a firm computer. Greenberg Traurig has also faced claims, and the ransomware group Silent Ransom Group has claimed responsibility for a breach at the firm.