Womble Bond Dickinson Reports Data Breach
A law firm headquartered in Winston-Salem disclosed that an unauthorized party accessed the personal data of 4,442 people.
Updated on Oct. 22, 2026 in Cybersecurity
Live Poll
Do you trust companies to protect your sensitive personal information from data breaches?
Womble Bond Dickinson reported a security incident on August 25, 2026, involving the unauthorized exposure of 4,442 individuals' personal information. The breach occurred after an attorney was deceived by an actor misrepresenting their identity.
Why it matters
The firm is responding by providing affected clients with 24 months of identity monitoring services to mitigate potential harm. Officials are also updating internal security protocols following the incident.
The incident involved the exposure of Social Security numbers, driver's licenses, and passports for 4,442 victims. The unauthorized party did not directly infiltrate the firm's network, but instead bypassed security via human deception.
The players
Womble Bond Dickinson
This is a full-service law firm with headquarters in Winston-Salem that manages legal matters for domestic and international clients.
Kroll
This is a global risk and financial advisory firm that provides services including cybersecurity and identity monitoring.
N.C. Attorney General's Office
This state-level government entity is responsible for legal oversight and consumer protection initiatives in North Carolina.
The details
An unauthorized actor successfully deceived a single attorney into sharing sensitive documents, bypassing the need for a direct system hack. The firm confirmed that no ransomware or business email compromise occurred during the event.
Timeline
The phishing incident began on August 20, 2026.
The firm became aware of the breach on August 25, 2026.
The official filing was submitted to the N.C. Attorney General's Office on October 9, 2026.
The Tech Race
This event reflects the ongoing battle between advanced cybersecurity tools and the persistent threat of social engineering, which remains a primary vector for data theft. By relying on human deception rather than technical flaws, the actor circumvented standard digital defenses.
Clients affected by the breach should monitor their personal financial statements and utilize the offered identity services to protect their sensitive information. The firm is currently enhancing security policies and training to prevent future social engineering attempts.
The takeaway
This incident serves as a reminder that human behavior remains a critical component of institutional cybersecurity. Employees and individuals should remain vigilant against verifying identities before sharing sensitive documentation through any communication channel.
Further reading
For more information on digital safety, visit Cybersecurity.
More information
Affected individuals can access Kroll identity monitoring services to secure their personal data.
Source note: This article includes information reported by The Charlotte Observer.
Live Poll
Do you trust companies to protect your sensitive personal information from data breaches?
