Law Firms Face Class Actions Over Data Breaches

Proposed suits target Baker McKenzie and Squire Patton Boggs after cyberattacks exposed personal information tied to each firm.

Updated on Nov. 6, 2026 in Cybersecurity

Law Firms Face Class Actions Over Data Breaches

Live Poll

Do you trust companies to keep your personal information safe from hackers?

Plaintiffs filed proposed class action lawsuits against global law firms Baker McKenzie and Squire Patton Boggs over cyberattacks that exposed personal information. The complaint against Baker McKenzie was filed Wednesday in the Northern District of Illinois, and the complaint against Squire Patton Boggs was filed the same day in the Northern District of Ohio.

Why it matters

The suits put pressure on professional services firms that hold sensitive client and personnel data, which can be a target for cybercriminals. Both firms have disclosed incidents involving unauthorized access to files, raising questions about how well such information is protected.

Baker McKenzie said a cybercriminal socially engineered two users in August to obtain a limited number of files, and it reported no independent malicious access to its system. Squire Patton Boggs said an unauthorized third party obtained a limited set of information, but the total number of affected records has not been disclosed.

The players

Baker McKenzie

A global law firm headquartered in Chicago that was named in a proposed class action over a cyberattack that exposed data from two of its users.

Squire Patton Boggs

A multinational law firm headquartered in Cleveland that was named in a proposed class action over a breach it disclosed in October.

The details

Baker McKenzie disclosed that a cybercriminal used social engineering against two of its users in August to gain access to a limited number of files, while stating there was no independent malicious access to its system. Squire Patton Boggs disclosed its breach in October, describing it as an unauthorized third party obtaining a limited set of information from the firm. Neither law firm responded to requests for comment from Reuters.

August: a cybercriminal socially engineered two Baker McKenzie users.
October: Squire Patton Boggs disclosed its breach.
Wednesday: proposed class action complaints were filed against both firms.

Market Landscape

Law firms increasingly hold the confidential records of corporate clients, making them attractive targets for social engineering that bypasses technical defenses. The two suits show how breaches at outside professional firms can expose the same kinds of personal data that companies are obligated to protect under state privacy laws.

Clients and employees whose personal information may have been involved should watch for notices from the firms and for any developments in the filed suits. Anyone who receives unexpected contact requesting account access should verify it independently before responding.

The takeaway

Social engineering remains effective because it targets people rather than systems, so verifying unexpected requests for access is a practical safeguard for any organization or individual.