Law Firm Data Breaches Expose SSNs at Holland & Knight, Squire

A run of disclosures with one method behind it

In the space of a few days, two more large US law firms disclosed breaches that exposed Social Security numbers. Holland & Knight, a Florida-based firm with roughly 2,200 lawyers and staff across 36 offices, showed up on the Vermont Attorney General's security breach list. The firm said an attacker used social engineering to get unauthorized remote access to one firm computer.1 Holland & Knight described the exposed material as a "small number of files" that included Social Security numbers. It said 14 clients were affected and had been notified, that it contacted law enforcement, and that its systems stayed up throughout the incident.1 Squire Patton Boggs reported its own breach involving Social Security numbers and said an unauthorized third party had obtained "a limited set of information."1

These two notices are not isolated. They follow a series of disclosures from some of the best-known names in the profession. In September, Quinn Emanuel and McDermott each notified law enforcement of separate breaches involving client personal data, and both incidents involved social engineering.1 Greenberg Traurig confirmed that an unauthorized actor reached a limited number of documents and posted them on the dark web. The data included names, contact details, dates of birth and Social Security numbers.1 Seyfarth Shaw said someone posing as its IT help desk talked an employee into emailing client documents to an outside account.9 Filings with the Texas and California attorneys general put the Seyfarth figure at no fewer than 300 people whose names and Social Security numbers were exposed.6 Sheppard Mullin now faces a proposed class action over a breach that its own notice says involved Social Security and driver's license numbers.2 Nelson Mullins was sued separately over claims that it failed to protect private data.1

Social engineering, not a zero-day

The striking thing for security teams is how little technical sophistication these breaches needed. None of the firms points to an unpatched vulnerability, a zero-day exploit or a missed critical patch. The entry point in each case is a person. Firm statements and trade coverage keep describing the same scenario: an attorney or staffer is persuaded to grant remote access, upload files or send documents to an attacker posing as IT support.129

This means the industry's usual response to a breach wave — patch fast, watch vulnerability disclosures, harden the perimeter — is necessary but does not address how these attacks actually work. FBI guidance, as summarized in threat-intelligence reporting, says this attack chain starts with callback phishing emails using invoice, billing, subscription or IT-themed lures, or with direct calls from someone claiming to be IT support.13 If that doesn't work, the attackers move to physical intrusion. An FBI warning from May 2026 described operatives posing as IT staff who walked into offices, said they had to back up a machine because of a "phishing issue," and plugged storage devices into computers.12

The reading here is that the legal sector's main exposure is procedural, not technical. Firms that can patch a VPN appliance in hours may still have no reliable way for an associate to check whether a help-desk caller is genuine.

The threat actor behind much of it

Threat intelligence increasingly ties this pattern to one crew: Silent Ransom Group, also tracked as Luna Moth, Chatty Spider and UNC3753.13 Holland & Knight has not publicly named its attacker, but it said the group had targeted other law firms, and cyber-intelligence sites attributed the incident to Silent Ransom Group.8 Over the past several weeks, the group has also posted claims against O'Hagan Meyer and Clark Hill.1718

A leak has made the group's operations far more visible. An archive of 5,692 chat messages attributed to Silent Ransom Group, covering August 27, 2025 to September 29, 2026, appeared on an onion site in early October under the title "The Luna Moth Files."13 DataBreaches.net added up 27 entries the group marked as paid at about $206.95 million. The median was $6 million and the largest was $30 million.16 According to reporting on the chats, the alleged payments ran from April 3 to September 24, 2026.14

The leaked ledger includes Squire Patton Boggs at a reported $20 million, but no breach confirmation tied to that entry was listed at the time.16 Holland & Knight does not appear among the 27 named payers.16 That matters: the Squire disclosure may be connected to a large extortion, but the record so far does not show the firm paid anything.

The verification picture is mixed, and the coverage agrees on that. Chainalysis said some leaked wallet addresses sit downstream of millions of dollars the group extorted, but it would not vouch for every claim. The group told DataBreaches.net it denies being breached at all.13 Crystal Intelligence traced the payout wallets to a collection address that has received about 2,675 bitcoin over its lifetime.1314 The chats also describe Telegram-recruited "agents" sent into US law firm offices. In one preserved negotiation, a New York firm said its executives had authorized $1 million after someone copied files onto a flash drive on its premises.13 More extreme plans discussed in the archive, such as kidnapping, have not been shown to have happened.13

Ransomware without encryption

The coverage differs on labels, and the difference has practical consequences. Several outlets and leak-site trackers call Silent Ransom Group a ransomware gang. But reporting on the leaked chats stresses that the group steals data and threatens to publish it without encrypting victims' files.1416 That explains why Holland & Knight could say its systems stayed operational.1 Nothing was locked up. The damage was the theft.

The numbers also show how far apart different counting methods are. A dataset that counts only ransomware attacks on law firms confirmed by public records lists 21 confirmed attacks so far in 2026. It names LockBit as the most-attributed group over its full 2018–2026 history, and puts the United States at 80% of all cases.11 Recent entries in that dataset, though, are increasingly attributed to "LeakedData/Silent Ransom Group," including Greenberg Traurig, Fox Rothschild, Weil, Chartwell and Jones Day.11 The same tracker records a payment by Weil.11 Meanwhile the leaked chats claim 27 paying firms in six months.16 In our view, both can be accurate, and the gap is the real story. Pure-extortion attacks that firms settle quietly seldom show up in public breach records, so the confirmed counts are best treated as a floor.11

The Greenberg Traurig case shows how inconsistent the figures can be. The firm described a limited number of documents being accessed.1 The tracker, citing a California attorney general filing, lists 150,000 records.11 Smaller details differ as well. One outlet says the Vermont filing for Holland & Knight lists two residents3, while others say it lists one.48 Sources also give Squire Patton Boggs' disclosure date as October 81 or October 9.3

The litigation multiplier

Whatever the attackers collect, plaintiffs' lawyers are close behind. Firms that represent corporate clients in breach litigation now face proposed class actions themselves. Sheppard Mullin is a clear example. The firm says an attorney was hit by a social engineering attack and that nobody accessed its systems or network, while the plaintiff argues the firm failed to protect the data.2 WilmerHale faced a proposed class action after a July notice covering about 11 Vermont residents whose names and Social Security numbers were involved.3 Claimant-side firms were advertising investigations into Holland & Knight within a day of its Vermont filing.48

Delayed disclosure makes the exposure worse. Chartwell Law's timeline, with an April intrusion and notification letters in August, is typical of these filings. During that gap, affected people do not know their Social Security numbers may already be in use.3 Holland & Knight has not said when its incident happened or how many people were affected in total.1

What defenders should take from it

The threat intelligence points to a few conclusions. First, Social Security numbers are a byproduct here. The attackers want leverage, and a firm's duty of confidentiality to its clients gives them plenty. FBI guidance says the group pressures victims by contacting their clients directly to say their data was stolen.13 Second, public warnings have not stopped the tactic. The FBI described office visits in May 2025, and the leaked chats show agents still being recruited and managed into 2026.13 Third, paying carries its own risk. Treasury's OFAC has warned that payment does not guarantee data will be deleted and that sanctions penalties apply on a strict-liability basis.13

The group may also rebrand. The leaked chats end with members discussing a relaunch as "Sleepless Threat."13 The FBI's indicators describe behavior rather than a name: an unscheduled visitor claiming to be IT, or a remote-access tool nobody approved.13 For the legal industry, the fix after this wave will be less about patches and more about verifying every caller, every walk-in and every remote-access request, regardless of who the person claims to be.