Holland & Knight Data Breach: Social Engineering Exposes 14 Clients

What Holland & Knight disclosed

Holland & Knight, one of the largest law firms in the United States, has confirmed a data security incident. The firm says an attacker used social engineering to get unauthorized remote access to one of its computers. It describes the exposure as a "small number of files" containing information that included Social Security numbers, and says it notified 14 affected clients.9 The disclosure appeared on the Vermont Attorney General's security-breach list on October 8, 2026, and Law360 reported it the next day alongside a separate incident at Squire Patton Boggs.25

The Vermont filing lists two Vermont residents among the people affected.2 The firm says its systems stayed up throughout the incident, client services were not disrupted, and it has contacted law enforcement.2 Cybernews puts the firm at about 2,200 lawyers and professionals across 36 offices worldwide. It notes that the firm has not said when the intrusion happened or how many people were affected in total.9

The core facts are the same across every outlet that covered the filing: social engineering, remote access to one machine, a handful of files, Social Security numbers, 14 clients.4912 The disagreements come from what sat on the public record before the firm said anything.

A different story on the leak sites

About five weeks before the Vermont filing, Holland & Knight's name began appearing in ransomware and dark-web tracking feeds. A threat-intelligence aggregator recorded the firm as a victim on the "leakeddata" extortion site on September 1, 2026. It described the group as a financially motivated ransomware-as-a-service operation.8 Breachsense logged the firm's domain on September 2 under a claim from a group it calls BusinessDataLeaks, with the size of the leak unknown. A consumer breach site published on the same day linked the incident to a group it called SilentRansomGroup and labeled the attack method ransomware.3 A plaintiffs' firm also announced an investigation on September 3, citing dark-web monitoring reports that named Holland & Knight.6

These early accounts do not agree with each other, and they do not match what the firm later disclosed. Three trackers attach three different group names to the claim. One security blog stated plainly that the leakeddata listing was an unverified assertion made during an extortion attempt, not proof that a breach occurred. It added that the listing named no specific data categories, no count of affected people and no incident date.10 The consumer site's list of exposed data, which included financial account details, employment records and case documents, is framed as the kinds of data law firms typically hold, not as confirmed findings.3

The firm's own filing gives a much narrower picture: no named actor, no ransomware, no outage.2 No coverage confirms whether the September leak-site claims and the October disclosure describe the same event. Several outlets that reported the filing state that no hacking group has been publicly identified.213

My reading is that the October filing is the only verified account, and the leak-site listings should be treated as unconfirmed. Still, the timing is hard to dismiss. A firm named on extortion sites in early September filed a breach notice in early October, and nobody has explained whether those are one incident or two. That open question is the most important unresolved part of this story. Both Holland & Knight and law enforcement have reason to clarify it.

No zero-day, no missed patch

For security teams, the main point is how the attacker got in. Holland & Knight says it was social engineering, not a software exploit.4 That means tricking a person into handing over credentials, approving a login or granting access, rather than breaking a technical control.4 No vulnerability disclosure is involved, no emergency patch would have stopped it, and no vendor advisory applies.

This fits a wider pattern. Two of the confirmed 2026 law-firm cases, Holland & Knight and Chartwell Law Offices, both named social engineering as the method.2 Chartwell's timeline is a warning: an intrusion reported in April 2026 led to notification letters dated August 7, roughly four months later.12

One analysis frames the weak point as the help desk: in an otherwise hardened network, the easiest target is often the person answering a support call.4 The practical response that coverage points to is phishing-resistant multi-factor authentication and stricter identity checks at the help desk. Clients are being encouraged to ask their outside counsel about both.

The absence of ransomware also matters. One report notes that Holland & Knight avoided the kind of ransomware outage that has hit other professional-services firms this year.4 Both Holland & Knight and Squire Patton Boggs are effectively telling clients that they lost some data but kept control of their networks. Clients deciding whether to stay with a firm after a breach care about that difference.4

Part of a wave of law-firm breaches

Holland & Knight is not alone. Squire Patton Boggs, a global firm with about 1,500 lawyers, reported that an unauthorized third party obtained a "limited set of information" that included Social Security numbers. Its regulatory filing also named two Vermont residents. There is no public evidence linking the two incidents.4

Earlier in 2026, Sheppard Mullin, Greenberg Traurig, WilmerHale, Chartwell and Peña & Bromberg all disclosed separate incidents.12 Law360 Pulse reported that Seyfarth Shaw disclosed a breach affecting more than 300 people, part of a wave the outlet partly linked to AI-assisted attack tools.4 Privacy Rights Clearinghouse data cited in coverage counts 113 legal-sector breach events in the first half of 2026, up from 64 in the first half of 2022.4

The pattern looks like attackers going after law firms as a way to reach client data, instead of attacking the clients directly.12 One analysis argues that law firms now serve as a reliable route into the data of companies that have locked down their own networks.4 The data supports that reading. Fourteen clients is a small number, but these are Social Security numbers belonging to high-value clients, held by firms that are often hired to defend other companies in breach lawsuits.2

Lawsuits and state rules

The legal consequences now move fast. WilmerHale went from a July 10 breach notice to a class action in D.C. federal court on July 14, four days later.2 Sheppard Mullin was sued days after notifying state attorneys general, and Greenberg Traurig faced class actions in September.12 One analysis suggests plaintiffs' firms now watch state breach portals specifically for law-firm filings.12 As of the latest coverage, no lawsuit against Holland & Knight has been identified, although one plaintiffs' firm began investigating in September.26

All of these disclosures went through individual state attorneys general, not a single federal system.2 That patchwork explains why the public numbers are so small. Vermont requires detailed filings even when only a few residents are affected, so a filing can show a tiny local count while the full scope goes unreported in other states. Texas has amended its law to require notice to its attorney general within 30 days of discovering a breach.12 Connecticut has proposed requiring forensic reports on root causes for large breaches. Holland & Knight's own attorneys analyzed that proposal earlier this year.

What to watch

Three questions will decide how this incident is judged. First, does Holland & Knight file in more states and raise the count beyond 14 clients? One analysis expects an upward revision if the files involve clients in several jurisdictions.4 Second, does anyone credibly connect or separate the October disclosure and the September leak-site claims? Third, does law enforcement or the firm ever name a responsible group? Doing so would place the incident within a larger campaign instead of leaving it as a standalone event.

For now, I take the firm's account at face value: a contained intrusion carried out by tricking a person, not by exploiting software. That is not much comfort. Patching cannot fully fix a social-engineering attack, and the legal sector's breach numbers suggest attackers know it. Anyone who receives a notice should freeze their credit, sign up for any monitoring the firm offers, and read the actual letter rather than relying on news coverage.