Law firm breach notices: what three firms' social engineering incidents say about client data

What the three notices are

This guide covers three notices filed with the California Attorney General. Baker & McKenzie LLP dated its letter October 27, 2026. Fragomen, Del Rey, Bernsen & Loewy, LLP and Sheppard, Mullin, Richter & Hampton LLP both dated theirs October 2, 2026. The working title for this guide mentioned four firms, but only these three documents were available, so nothing here covers a fourth.

All three are sample letters sent to affected people, not regulatory filings with incident statistics. Each describes a social engineering incident. None names the attacker or describes the method in technical detail.

How the attackers got in

The three notices describe the entry point in different terms.

Baker McKenzie says two of its users were targeted. The notice states: "On August 14 and 17, 2026, a threat actor socially engineered two of our users and obtained a limited number of files." The firm also says it has no evidence of wider compromise.

Fragomen describes remote access to one account. Its letter says that on May 5, 2026 the firm learned of the access and tied it to a campaign. Note the wording: Fragomen says "campaign", which is the only notice to frame the event that way.

Sheppard describes a disclosure by one person rather than remote access. The notice says an attorney was the victim on August 31, 2026. It adds that the firm's network was not compromised. The firm says it became aware of the incident the next day.

Across the three, the common point is that a person or account was manipulated. Baker McKenzie and Sheppard each state that their systems or other accounts were not otherwise compromised. Fragomen's letter does not make a statement of that kind.

Which files were taken

The notices describe the volume of files in general terms only.

Baker McKenzie says "a limited number of files" were obtained, as quoted above. Fragomen says the third party "accessed and copied a subset of files." Sheppard refers to "certain documents" disclosed to an unknown third party, also quoted above. None of the letters gives a file count, a file type or a client matter.

The notices explain that the firms had to review the files to work out whose information was in them. Baker McKenzie and Sheppard use nearly identical wording. Each says the review found the recipient's personal information in one of the impacted files. Fragomen says its review turned up personal information as well.

The data types are not stated in the sample letters. Sheppard's sample reads "Specifically, your were in an impacted file", with the data field left empty. Baker McKenzie's sample has the same gap, and Fragomen's has the placeholder "[Extra1]" after the word "name". Each individual letter would presumably fill in the data types, but the samples filed do not say which ones.

One of the three notices gives a count of affected people. Sheppard states: That figure covers one state only, and the notice gives no overall total.

What the firms offer affected people

All three offer 24 months of credit or identity monitoring at no cost. The vendors and details differ.

Baker McKenzie offers TransUnion credit monitoring, delivered through Cyberscout. The recipient must enroll by January 27, 2027. Attachment A to the same letter gives a different deadline format, saying enrollment must happen within a set window from the letter's date. The notice's own attachment describes the product as single bureau monitoring, report and score, and says it includes proactive fraud assistance.

Fragomen offers Experian IdentityWorks. The enrollment deadline is January 29, 2027. The attachment lists identity theft insurance as part of the features. It also says a credit card is not needed to enroll, and that identity restoration support runs for one year from the date of the letter.

Sheppard offers TransUnion services through Cyberscout and lists the components. The deadline is December 31, 2026.

The deadlines differ by weeks. Sheppard's falls in 2026, while Baker McKenzie's and Fragomen's fall in January 2027. Baker McKenzie and Sheppard also set up call centers, with weekday hours of 8 a.m. to 8 p.m. ET. Fragomen lists a number for questions with weekday hours of 9 a.m. to 9 p.m. Eastern.

What the notices say about misuse and what recipients can do

Two of the three notices say they have found no misuse. Fragomen's letter states: Sheppard says its investigation "has not revealed evidence of any fraudulent use." Baker McKenzie's letter does not make an equivalent statement.

The recommended steps are similar across the letters. Baker McKenzie and Sheppard both tell recipients to review account statements and credit history, and Baker McKenzie adds a caution about unsolicited messages and attachments. Fragomen asks recipients to review account statements and free credit reports. All three attach information on free credit reports, fraud alerts and security freezes, plus state attorney general contacts.

Sheppard's attachment is the only one that covers tax fraud. It points to the IRS Identity Protection PIN.

What is missing from these notices

For a security leader comparing incidents, the gaps matter as much as the content.

• None of the notices describes the social engineering method, such as the channel or the pretext used.
• None gives the number of files or the total number of people affected.
• The sample letters leave the exposed data types blank or as a placeholder.
• The firms describe their response in general terms: forensic experts, law enforcement notification and added security measures. They do not describe specific controls.

Readers who need these details would have to look in other filings or ask the firms. These three documents do not provide them.