Blog post2026-10-30By Tyson Benson

Baker McKenzie and Troutman Pepper Locke Data Breaches: Lessons for Law Firms

Baker McKenzie and Troutman Pepper Locke data breach notices describe social engineering and released documents. What law firms should verify and practice.

Managed Phishing Simulation for Law Firms Discuss a campaign

Reportedly it took the social engineering of just two employees out of thousands to result in a data breach at one of the largest law firms in the United States. In filings with relevant U.S. state entities, Baker McKenzie and Troutman Pepper Locke recently disclosed cyber breaches that occurred this past August.

The Baker McKenzie and Troutman Pepper Locke cyber breach notifications, reported by Reuters on October 29, reveal two different incidents involving social engineering and sensitive documents.

For a smaller firm, the question is practical: if a convincing request asked someone to send client files somewhere new, would they know how to pause and verify it?

What the two notices describe

In its notice filed with the California Attorney General, Baker McKenzie says a threat actor deceived two users on August 14 and 17, 2026, and obtained files containing personal information. The firm says it engaged forensic specialists, notified law enforcement, and contained the incident.

The firm found no evidence of compromised credentials or additional user accounts, or of separate malicious access to its systems. Its notice concerns personal information obtained through legal services provided to clients.

In its filed notice, Troutman Pepper Locke describes an August 7 incident. An employee interacted with communications that appeared legitimate and sent documents to an unauthorized person. The employee later recognized something was wrong and reported it to the security team. Troutman says the incident did not disrupt operations and the recipient did not gain access to its systems.

The incidents differ, and the notices do not establish a common attacker. Both focus on sensitive documents obtained through social engineering, rather than a broad network intrusion.

A request can look routine until you check it

Law firms send documents all day: to clients, opposing counsel, courts, vendors, and colleagues. A fraudulent request can borrow the language and urgency of any of those exchanges.

Imagine a message that appears to come from a client facing a deadline. It asks an assistant to upload identification records to a new folder. The assistant has access to the records and every reason to keep the matter moving. This is an example, not a description of either incident.

The pause belongs before the upload: who asked for the files, how do you know it was really them, and is this an approved destination?

A successful sign-in does not answer those questions. Backups can restore files after data loss; they cannot retrieve a copy already sent to someone who should not have it.

What the FBI warning adds

The FBI’s May 26 warning about Silent Ransom Group describes criminals targeting law firms with phishing messages and calls impersonating IT personnel. It recommends clear ways to verify support requests and practice recognizing, resisting, and reporting suspicious ones. Additionally, CrowdStrike just released its CrowdStrike 2026 Legal Threat Landscape Report and stated that the threat actor group CHATTY SPIDER's activity targeting "legal entities grew 129% in the first eight months of 2026 compared to all of 2024."

Staff need to recognize not only suspicious messages, but also risky requests to share files, grant access, or move information.

Make the safer choice easier

Use a contact method you already trust

If a document request is unusual, confirm it with the requester through a number or address already on file. A phone number or link included in the new request is not an independent way to verify it.

Keep approved support contacts somewhere staff can find quickly. The IT support callback guide offers a procedure for checking unexpected calls and support requests.

Decide who can approve an unusual transfer

Select the kinds of transfers that need a second person’s review. That might include bulk matter exports, identification or medical records, or uploads to a new external destination.

Name the approver and make sure staff can reach them when a deadline is pressing. A clear process gives an employee permission to pause without feeling they are holding up client service.

Ask your administrator or IT provider whether the firm’s sharing settings support the process. Microsoft’s guidance on restricting external sharing of sensitive SharePoint and OneDrive files is a useful starting point. Check which controls your licenses include and test them with fictional data.

Rehearse a request your team might actually receive

Use a scenario that feels familiar to your team: a client asking for a document, an e-filing notice, or an unexpected sharing invitation. Ask staff to walk through how they would verify it and where they would report a concern.

Talk through what went well and what should change. If you track email interactions, account for automated security tools before drawing conclusions about an employee’s response.

Make it easy to report a mistake

Troutman’s notice says the employee recognized the suspicious interaction and reported it. Every firm needs a clear way to raise a concern, including when someone realizes a file has already gone to the wrong place.

Tell staff whom to contact and what details to share: the original request, recipient or destination, approximate time, and documents involved. Prompt reporting gives the response team a chance to assess the incident and preserve evidence.

Agree with your office manager and IT provider who will receive that report and what happens next. A reporting address helps only if someone is watching it.

Put your firm’s response into practice

SYLF’s Managed Phishing Simulation for Law Firms gives staff recurring practice with monthly email simulations and weekly law-firm decision challenges. The program also includes targeted learning and quarterly leadership reviews. We select the scenarios, coordinate delivery, and discuss the results with your firm.

Managed plans start at $199/month for up to 10 people. A one-time campaign starts at $395.

See Managed Phishing Simulation for Law Firms →

Discuss a campaign for your firm →

Bring one request your staff regularly handles. We can help turn it into a practical exercise using fictional details.