Law Firms Herbert Smith Freehills Kramer and Taft Report Data Breaches in 2026 Two prominent U.S. law firms Herbert Smith Freehills Kramer LLP and Taft Stettinius & Hollister LLP have disclosed data breaches to state regulators, joining a growing list of legal industry targets in 2026. The incidents reflect an escalating trend of cyberattacks against law firms, which handle sensitive client data, including corporate, financial, and litigation records. While specific details about the breaches such as the attack vectors, scope of compromised data, or threat actors involved remain undisclosed, the disclosures highlight the persistent cybersecurity risks facing the legal sector. Law firms have increasingly become prime targets for ransomware groups, state-sponsored hackers, and financially motivated cybercriminals due to their access to high-value confidential information. The breaches follow a surge in similar incidents reported by U.S. law firms in 2026, underscoring vulnerabilities in legal industry cybersecurity practices. Regulatory filings indicate that firms are required to notify affected parties and authorities, though the full impact on clients and operations is still being assessed. As cyber threats evolve, the legal sector continues to grapple with balancing client confidentiality, regulatory compliance, and robust security measures. The latest breaches serve as a reminder of the sector’s ongoing challenges in safeguarding sensitive data against sophisticated attacks.

The Maine Office of the Attorney General reported a data breach involving Taft Stettinius & Hollister LLP on April 18, 2024. The breach occurred between October 17, 2023, and October 20, 2023, due to unauthorized access from an external system breach, potentially exposing Social Security numbers of a total of 5,980 individuals, with 2 Maine residents affected. Written notice was sent on April 18, 2024, and identity theft protection services were offered for 24 months through Experian.