Editor’s Note: Data breach notices from Baker McKenzie and Troutman Pepper Locke, listed on the California attorney general’s register as reported Oct. 27 and Oct. 28, 2026, each say social engineering, meaning the deception of firm personnel, gave outsiders files from the firms’ legal work in August. A ComplexDiscovery review of the register found eight more law and immigration firms reporting incidents dated May or August 2026: Fragomen, Peña & Bromberg, WilmerHale, Blank Rome, Fox Rothschild, Seyfarth Shaw, Greenberg Traurig and Sheppard Mullin. Seven of the 10 notices describe social engineering or impersonation, one describes a network intrusion, and none names an attacker. A proposed class action against Troutman alleges that a group called SilentRansomGroup claimed its incident.

California law has required businesses that own or license the data to notify affected residents within 30 calendar days of discovering or being notified of a breach since Jan. 1, with delay allowed when law enforcement determines notice would impede a criminal investigation or as necessary to determine a breach’s scope.

For cybersecurity, information governance and eDiscovery professionals, several filings point to reviewing matter files for personal data as one step that takes time. Watch the register for further firm and vendor filings.


Content Assessment: A cluster of law firm breach notices on California's register points mostly to deceived staff

Information - 93%
Insight - 91%
Relevance - 90%
Objectivity - 90%
Authority - 88%

90%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "A cluster of law firm breach notices on California's register points mostly to deceived staff."


News Analysis – Cybersecurity Beat

A cluster of law firm breach notices on California’s register points mostly to deceived staff

ComplexDiscovery Staff

California’s attorney general lists breach notices from Baker McKenzie and Troutman Pepper Locke as reported Oct. 27 and Oct. 28, each saying social engineering in August gave outsiders files from the firms’ legal work.

The two notices are not outliers on the state’s public breach register. A ComplexDiscovery review of this year’s entries found eight more law and immigration firms reporting incidents dated May or August 2026, and in their own accounts, seven of the 10 describe social engineering or impersonation. One describes an intruder inside its network. Each appears on the register with a reported date weeks or months after the incident it describes.



What 10 firm notices say happened

The May group came first. Fragomen, Del Rey, Bernsen & Loewy, which calls itself a global immigration services firm, said it learned May 5 that an outsider had gained remote access to one user’s account as part of what it called a social engineering campaign. Peña & Bromberg, a California law firm, said it detected irregular activity in its network May 7 and found that an unauthorized actor had gotten into certain computer systems and taken files. Wilmer Cutler Pickering Hale and Dorr, which signs its notice WilmerHale, said that on May 8, a member of its personnel mistakenly gave information to a third party posing as someone else. On May 21, Blank Rome said, a caller posing as its IT department misled an attorney into moving files to a Google Drive account outside the firm. The same day, Fox Rothschild said, an employee was targeted by “vishing,” or voice phishing, and files were copied and taken.

August brought five more. Troutman said an employee hit by a social engineering attack on Aug. 7 mistakenly sent documents to an unauthorized person. Baker McKenzie said an attacker used social engineering on two users on Aug. 14 and Aug. 17 and came away with a limited number of files. Seyfarth Shaw said it found Aug. 18 that a small number of documents had been emailed to someone not authorized to receive them, and that nothing beyond those documents was involved. Greenberg Traurig said an unauthorized person obtained a small set of files Aug. 26, and Sheppard, Mullin, Richter & Hampton, known as Sheppard Mullin, said a single attorney was the victim of a social engineering event Aug. 31.

The wording differs from notice to notice, and the differences matter. Five notices use social engineering to describe the incident itself: Fragomen, Fox Rothschild, Troutman, Baker McKenzie and Sheppard Mullin. WilmerHale and Blank Rome describe impersonation instead, and Blank Rome uses the term only for the training it added afterward. Seyfarth does not say how the email reached the wrong recipient, Greenberg Traurig does not describe the method, and Peña & Bromberg describes an intrusion into its systems. Fox Rothschild’s notice put the social engineering category plainly, describing attacks that “rely on deception rather than technical intrusion.”

Six firms limit the reach of their incidents, each in its own terms. Troutman and Sheppard Mullin say the outsider did not get into firm systems, WilmerHale says the third party did not directly access them, and Baker McKenzie reports no independent malicious access. Seyfarth says it found no evidence of access to its network, and Fox Rothschild says the attack was confined to a single device and caused no broader compromise.

Whatever the reach, the information at stake came to these firms through legal work, several notices say. Baker McKenzie and Sheppard Mullin each said they held the recipient’s information in connection with legal services provided to clients, Troutman tied it to a legal matter and Blank Rome to a client matter. Recipients may therefore include people who are not clients. For information governance teams, that is the quiet lesson in the filings: personal data that rides along in matter files becomes the firm’s breach exposure, so retention schedules and minimization at intake can affect how many letters an incident produces.

Baker McKenzie’s and Troutman’s California samples do not say how many letters went out. Texas publishes counts of affected Texans. Its register lists 80,528 for WilmerHale, 4,194 for Troutman, 3,002 for Blank Rome, 2,326 for Sheppard Mullin, 1,839 for Greenberg Traurig, 831 for Baker McKenzie, 422 for Fox Rothschild, 379 for Fragomen and 305 for Seyfarth. A search of the Texas register found no Peña & Bromberg entry. Those counts cover Texas residents only, and the state says they may change after listing. A proposed class action filed in federal court in Atlanta in August by Travis Wilson, a West Virginia resident, alleges about 37,000 people were exposed in the Troutman incident, Atlanta Journal-Constitution reporter Rosie Manins reported.

Where the FBI warning fits, and where it stops

Wilson’s complaint also alleges that a group calling itself SilentRansomGroup claimed the Troutman attack online, the newspaper reported. The claim is an allegation in a complaint, and Troutman’s notice names no attacker. The FBI, for its part, has described the group’s methods in detail. In a May 26 FLASH alert, which the bureau provides “as is” for informational purposes, the FBI said the Silent Ransom Group, also tracked as Luna Moth, Chatty Spider and UNC3753, has consistently targeted U.S.-based law firms since spring 2023. As of spring 2026, the alert said, the group’s actors pose as employees of a victim’s IT department through phone calls and phishing emails.

The alert also said the group’s actors exfiltrate data to “internal filesharing platforms such as Google Drive or Microsoft OneDrive,” and that its recent campaigns left little trace on the machines they compromised. Blank Rome’s account of a caller posing as IT and files moved to a Google Drive account shares two elements with the alert: the IT pretext and the use of Google Drive. Shared elements are not attribution, though: Blank Rome’s notice names no attacker, and neither do the other nine.

California’s 30-day clock and the delay it allows

Whoever was behind the incidents, each firm’s notification clock ran under the same California statute. Civil Code Section 1798.82 requires a business that owns or licenses computerized personal information to notify California residents whose unencrypted information was, or is reasonably believed to have been, acquired by an unauthorized person. As amended by Senate Bill 446, effective Jan. 1, the section sets a deadline: the disclosure is due within 30 calendar days of discovering or being notified of the breach. The same section lets a business delay that disclosure “to accommodate the legitimate needs of law enforcement,” or “as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.”

The law enforcement route has a condition. It applies when a law enforcement agency determines that notification will impede a criminal investigation, and notice must follow promptly once the agency determines it will not.

A separate subsection governs the register itself. A business that must notify over 500 California residents from a single breach has to submit a sample notice to the attorney general within 15 calendar days of notifying consumers. The statute does not say when the register posts a sample, and the register does not define its reported date, which this article uses for its timing comparisons. Because the 30-day clock also starts at discovery, which several notices do not date, the register alone cannot show whether any firm met the deadline.

With that limit stated, the spread is still wide. The comparison runs from the latest incident date each firm reported to the earliest reported date listed for its sample. On that measure the gap runs from 14 days for Greenberg Traurig, Aug. 26 to Sept. 9, to 150 days for Fragomen, May 5 to Oct. 2. The register lists the same Greenberg Traurig sample again Oct. 1. Peña & Bromberg’s gap is 140 days, Baker McKenzie’s is 71 from its second incident date and Troutman’s is 82.

The notices identify file review as part of that interval, though not all of it. Baker McKenzie described “a thorough and extensive analysis of the impacted files” to find whose personal information they held, Sheppard Mullin described “a thorough and time-intensive analysis,” and Peña & Bromberg said its review of the files had recently concluded. Fox Rothschild said it finished its file review June 18, 28 days after its incident, and its reported date on the register is July 16. Blank Rome said it identified affected individuals on or around May 28, a week after its incident, and its reported date is June 26.

For eDiscovery and information governance teams, that is familiar work. Finding personal information inside unstructured legal files is a document review problem, and a firm that can scope it fast has less need for the statutory delay route. Firms should build that capacity before an incident: a defined personal-data taxonomy, tested detection workflows and a written record of each review step, because the scope route permits delay only as necessary.

Vendors that hold documents for customers filed too

Law firms were not the only document holders on the register this year. Indico Data Solutions has two California samples on the register, reported Aug. 27 and Oct. 27, the second on the same reported date as Baker McKenzie’s, and Texas lists 2,128 Texans affected. The Boston company describes itself in its notice as a vendor that provides “data ingestion and workflow organization services to companies in various industries,” and it tells recipients it would have their information if a customer provided it. It said it determined May 7 that an intruder may have reached online repositories holding customer information. Bloomberg Law reported Aug. 14 on a proposed class action over the incident, and Indico’s web notice says the company is notifying people on behalf of its corporate customers while its data review continues.

California law splits the duty in two. A business that owns or licenses the data must notify residents. A business that maintains data it does not own must notify the owner immediately after discovery, when the information was, or is reasonably believed to have been, acquired by an unauthorized person. Indico’s October California notice does not name its customers, and nothing in that filing ties it to the law firm incidents.

Deposition Solutions, which does business as Lexitas, brought a different problem to the register in a notice reported Oct. 22. The litigation support company said a customer told it May 29 that a misconfigured web server had left files in its OnDemand (DepositionNet) application open to anyone online, with no login required, since about September 2019. The files were mainly deposition transcripts, exhibits and other legal documents. Lexitas said personal information in them was “scattered throughout written testimony rather than organized in a searchable database,” so its manual review took several months. Limited server logs left it unable to determine whether a given person’s information was viewed, copied or downloaded.

That last detail gives litigation support buyers a checklist for their next vendor review: ask how file portals authenticate users, how long access logs are kept and how quickly the contract requires breach notice to the data owner.

Practical steps the notices point toward

For the firms themselves, the FBI’s recommendations mix procedural and technical controls. Among the procedural ones, the bureau advises firms to set and communicate policies on how IT support will contact and authenticate itself to employees. It also recommends phishing-resistant multifactor authentication and, where possible, turning off remote access and blocking external drives on computers that can reach sensitive data. The incidents the notices describe point to two more controls: block uploads to personal cloud storage from firm devices, and require a callback to a known number before anyone sends client documents at a stranger’s request.

Clients can use the register too. It is searchable by organization name, and outside counsel guidelines can ask firms to disclose any filing on it, along with the review timeline behind it.

Baker McKenzie’s and Troutman’s notices were reported a day apart, and neither describes a firewall failing. Both describe people at the firm who were deceived. If the next notice on California’s register comes from your firm or your vendor, could it reach affected people within 30 days, and if not, would a statutory ground for delay actually apply?



News Sources



Assisted by GAI and LLM Technologies

Additional reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).