Fox Rothschild data breach: a May 2026 vishing attack on one employee, files taken, 54,244 people notified

What happened at Fox Rothschild?

The firm noticed unusual activity on a single employee account on May 21, 2026, and opened an investigation with outside forensic specialists. That investigation found the employee had been targeted the same day by what the letter calls vishing, and that files were copied and taken. The letter explains the term itself: social engineering attacks rely on deceiving people rather than on technical intrusion. The letter does not say who called, what the caller asked for, or where the files went.

Date	What happened	Source
May 21, 2026	Vishing attack; files copied and taken; unusual account activity found	Letter; Washington notice
June 18, 2026	File review completed; personal information found	Letter; Washington notice
July 16, 2026	Notice to 1,891 Washington residents; Indiana's notice date; Massachusetts logs it	Washington notice; Indiana and Massachusetts records
July 17, 2026	Texas publishes the report	Texas record

The review of the taken files, with a third-party specialist, ended on June 18, 2026. Letters followed 28 days later, 56 days after the attack. The notice-delay guide puts that against other notices in the log.

Was Blank Rome hit the same day?

Yes. Blank Rome, another law firm, says that on May 21, 2026, a caller posing as its IT department got one of its attorneys to upload files to an outside Google Drive account. Indiana records 57,577 people in that notice; the Blank Rome entry has the details. Neither firm's letter mentions the other or names an attacker, so the public record does not show whether the two calls were linked. Between them, the two notices reached 111,821 people by Indiana's totals.

What information was taken in the Fox Rothschild breach?

The filed California sample leaves the data line as a placeholder to be filled in per person. The Washington notice gives the list: name, Social Security number and date of birth. Texas lists name and Social Security number, and Massachusetts marks Social Security numbers only for its 72 residents. Washington's list matches its notice.

How many people were affected?

Indiana and Texas both record 54,244 people in total. The largest state count in the records is Washington's, 1,891 residents, then Texas with 422, Massachusetts with 72 and Indiana with 31. The notice does not say how the firm came to hold each person's information, or whose legal matter the files came from. California's record gives May 21, 2026 as the breach date.

What is Fox Rothschild offering?

Credit monitoring and identity protection through IDX at no cost. The Washington notice says twelve months; the California sample leaves 12 or 24 months to be filled in, so the letter gives each reader's term. Readers have to enroll themselves. Questions go to 1-855-830-5753 or response.idx.us/FoxRothschild, Monday to Friday, 9 a.m. to 9 p.m. Eastern. The firm says it is adding employee awareness training. The guide to credit monitoring offers compares offers like this one.

Was my information in the Fox Rothschild data breach?

If you got a letter from Fox Rothschild in mid-July 2026, your information was in one or more of the taken files. A reader may be named in a client's legal documents without being a client; the guide to letters from companies you never dealt with explains how that happens. Other law firm notices are compared in the law firm breach guide.

What the notice leaves open

• What the caller asked the employee to do, and where the taken files went.
• Whose legal matters the files came from.
• Whether the Fox Rothschild and Blank Rome calls the same day were connected.