Jones Day Breach Exposes Client Data via Third-Party File Transfer Platform Global law firm Jones Day is under regulatory scrutiny after hackers accessed gigabytes of sensitive client data and internal communications through a breach of the Accellion file transfer platform a third-party service the firm used for secure file sharing. The incident did not compromise Jones Day’s primary internal network but instead exploited vulnerabilities in the external vendor’s system. The U.S. Securities and Exchange Commission (SEC) is now investigating, requesting client names to assess whether material nonpublic information was exposed. A prior court ruling in a similar case affirmed the SEC’s authority to demand client identities in cyber investigations, though it limited disclosure to a subset of affected parties. Jones Day is actively investigating the breach and notifying impacted clients. The firm’s client roster includes major corporations, raising concerns about the potential exposure of confidential legal and business data. The breach underscores the risks of third-party vendor dependencies, as even organizations with secure internal systems can face regulatory, legal, and reputational fallout from a compromised external platform. The incident highlights the need for robust vendor risk management, particularly for services handling sensitive data.