Wiley Rein LLP Faces Proposed Class Action Over Alleged Chinese-Linked Data Breach On May 26, 2026, Washington, D.C.-based law firm Wiley Rein LLP was hit with a proposed class action lawsuit alleging negligence after the firm disclosed that a group potentially affiliated with the Chinese government accessed emails belonging to its personnel. The breach, which has not been publicly dated, raises concerns about cybersecurity vulnerabilities in legal sectors handling sensitive information. The lawsuit, filed in the U.S. District Court for the District of Columbia, accuses the firm of failing to adequately protect client and employee data from state-sponsored cyber threats. While details on the scope of the breach remain limited, the incident underscores the growing risks of targeted cyber espionage against high-profile organizations. Wiley Rein has not yet publicly responded to the allegations. The case is pending further legal proceedings.

U.S. Law Firm Wiley Rein Hit by Alleged Chinese-Linked Cyberattack, Faces Class-Action Lawsuit A proposed class-action lawsuit has been filed against prominent U.S. law firm Wiley Rein, alleging the firm failed to protect sensitive personal data stolen in a cyberattack believed to be carried out by hackers affiliated with the Chinese government. The complaint, filed on May 24, 2026, in the U.S. District Court for the District of Columbia, seeks damages for potentially thousands of affected individuals. According to the lawsuit, cybercriminals accessed Microsoft 365 email accounts belonging to Wiley Rein personnel between July 2024 and June 2025, though the breach was not detected until 2025. The stolen data allegedly includes names, addresses, dates of birth, financial account numbers, medical information, and Social Security numbers. Victims were not notified until March 6, 2026, nearly a year after the intrusion was discovered. Wiley Rein acknowledged in an internal investigation that the attack was likely conducted by a group with ties to the Chinese government. The firm has since offered affected individuals 12 months of complimentary credit monitoring and claimed to have strengthened its security measures. However, the lawsuit argues that the breach resulted from inadequate cybersecurity safeguards, including the lack of multi-factor authentication (MFA) and insufficient staff training, with the initial intrusion traced to a phishing email. The named plaintiff, Derrick Burkett, a Florida resident, alleges he had no direct relationship with Wiley Rein but believes his data was obtained through the firm’s representation of a client. Burkett claims the breach led to 19 fraudulent charges on a MetLife estate account. Wiley Rein, which employs 260 attorneys and specializes in regulatory legal services, particularly for the telecommunications industry, has not yet responded to requests for comment. The case (Derrick Burkett v. Wiley Rein, No. 26-cv-1791) highlights the growing threat of state-linked cyberattacks targeting law firms, which hold vast amounts of sensitive client data. The lawsuit argues that the firm’s failure to secure third-party data collected without explicit consent sets this breach apart from typical incidents.

Wiley Rein Faces Class Action Lawsuit Over Data Breach Exposing Thousands Washington, D.C.-based law firm Wiley Rein, a prominent Am Law 200 firm specializing in insurance and regulatory work, is now facing a class action lawsuit following a data breach that allegedly compromised the personal information of thousands of individuals. The suit, filed in the U.S. District Court for the District of Columbia, claims hackers accessed sensitive data in 2024, which was later sold on the dark web. The complaint alleges the firm did not detect the breach until June 2025 and failed to notify affected individuals until March 2026 nearly two years after the initial intrusion. Plaintiffs further accuse Wiley Rein of neglecting to implement "reasonable and appropriate" cybersecurity measures to prevent the attack. The lawsuit highlights a growing legal risk for law firms, as it includes individuals who were not direct clients but whose data was stored in firm records. The breach could have far-reaching consequences, including reputational damage, client distrust, and potential ethical violations for failing to protect confidential information. Additionally, delayed breach notifications may violate state data protection laws, exposing the firm to further regulatory action. Financially, the firm could face significant costs, including legal fees, potential settlements, and lost billable hours as partners and staff divert attention to the litigation. The incident may also deter top talent and new clients, compounding long-term harm. While Wiley Rein likely carries cybersecurity insurance, coverage could be voided if the firm failed to meet policy requirements for protective measures. The case underscores the need for law firms to prioritize cybersecurity, conduct regular audits, and maintain robust incident response plans to avoid similar fallout.