Weil Gotshal & Manges Hit by Cyberattack Exposing Client Documents On May 29, 2026, global law firm Weil Gotshal & Manges LLP confirmed it had suffered a cyberattack, resulting in a "limited number" of client documents being uploaded to an external cloud storage site. The breach was disclosed by Law360 Pulse, which verified the incident with the firm. Details remain scarce, but the attack appears to have targeted sensitive client data, raising concerns about potential exposure. Weil Gotshal, a prominent firm with offices in major financial hubs, has not yet provided further specifics on the scope of the breach, the threat actor involved, or the timeline of the attack. The incident underscores the ongoing cybersecurity risks faced by legal and professional services firms, which often handle highly confidential information. No additional details on remediation efforts or regulatory notifications have been released at this time.

Law Firms Under Siege: A Rising Tide of Cyber Attacks Targets the Legal Industry The legal sector is facing an escalating cybersecurity crisis, with law firms increasingly targeted by sophisticated threat actors. A recent survey by Arctic Wolf and Above the Law revealed that 39% of law firms experienced a security breach in the past year, with 56% of those incidents resulting in the loss of confidential client data a devastating outcome for an industry built on trust and discretion. ### Why Law Firms Are Prime Targets Several factors make law firms particularly vulnerable: - Digital transformation: Firms rely heavily on cloud-based applications and web platforms, expanding their attack surface. - Valuable data: They store vast amounts of sensitive client information, including financial records, PII, and privileged legal documents. - Lack of preparedness: Only 26% of firms consider themselves "very prepared" to respond to cyber incidents. - Resource constraints: Many lack dedicated cybersecurity personnel or struggle to meet evolving compliance standards. - Sophisticated threats: The average ransom demand for legal organizations reached $1 million in 2023, with attackers exploiting weak incident response (IR) plans and third-party vulnerabilities. ### Notable Cyber Attacks on Law Firms #### 1. Orrick, Herrington & Sutcliffe (2023) - Attack type: Data exfiltration (details undisclosed) - Impact: Compromised PII and health data of 637,000 breach victims, leading to multiple class-action lawsuits. - Target: The firm specializes in data breach litigation, making its own client records a high-value target. #### 2. Grubman Shire Meiselas & Sacks (2020) - Attack type: Ransomware (REvil group) - Demand: Initially $21 million, later doubled to $42 million after hackers leaked Lady Gaga’s legal documents. - Outcome: The firm denied paying the ransom, though reports suggest a partial payment of $365,000 was made. #### 3. Proskauer Rose (2023) - Attack type: Data breach via unsecured Microsoft Azure cloud server - Impact: 184,000+ files exposed for six months, including financial deals, NDAs, and acquisition documents. - Response: The firm secured the server and launched an investigation with cybersecurity experts. #### 4. HWL Ebsworth (2023) - Attack type: Ransomware (ALPHV/Blackcat) - Impact: 4TB of data (2.2 million files) stolen, including employee IDs, financial reports, and client documentation. - Aftermath: Hackers leaked 1.45TB of data on the dark web; an Australian court issued an injunction to block access. #### 5. DLA Piper (2017) - Attack type: NotPetya ransomware (originating in Ukraine) - Impact: Global disruption employees lost access to email, phones, and documents. The firm spent 15,000 hours in overtime rebuilding its Windows environment. - Attribution: Linked to Russian state-backed actors. #### 6. Mossack Fonseca (2016) - Attack type: Alleged hack (or insider leak) - Impact: 11.5 million documents (Panama Papers) exposed, revealing tax evasion schemes and shell companies. - Aftermath: Governments recovered $1.2 billion in unpaid taxes; the firm shut down in 2018 amid reputational damage. #### 7. Cravath Swaine & Moore / Weil Gotshal & Manges (2016) - Attack type: Insider trading via malware - Perpetrators: Three Chinese nationals stole confidential M&A data, earning $4 million in illicit profits. - Penalty: The SEC fined them $8.8 million. ### The Broader Impact Cyber attacks on law firms extend beyond financial losses. Breaches erode client trust, disrupt operations (e.g., frozen billing systems), and trigger regulatory scrutiny. Many firms remain silent about incidents due to lack of mandatory disclosure laws, leaving the full scope of the problem unknown. As threat actors refine their tactics from ransomware to phishing and insider threats the legal industry must confront its cybersecurity gaps or risk becoming a persistent target.