Fried Frank data breach: one account used to copy files from a shared drive, 46,602 people

What happened at Fried Frank?

The firm learned on October 27, 2025 that a single user account had been compromised and used to copy files from a shared drive. It says it contained the incident, blocked the access, investigated with outside data security experts and reported the matter to law enforcement. The investigation found that files were taken over about five days.

Date	What happened	Source
October 23, 2025	First file taken	Fried Frank notice; Indiana report
October 27, 2025	Firm learns the account is compromised	Fried Frank notice
Early morning of October 28, 2025	Last file taken	Fried Frank notice
Late 2025	Goldman Sachs notifies its own affected investors	SecurityWeek
January 13, 2026	JPMorgan Chase files its own notice with the Maine AG	SecurityWeek
January 30, 2026	Notice recorded in Indiana	Indiana report

Notice reached Indiana 99 days after the first file was taken. The notice-delay guide shows how that compares.

Why would a law firm have my data?

The letter says that as a large international law firm, Fried Frank sometimes receives personal information from clients and other third parties in connection with its services. SecurityWeek reported that two of those clients, Goldman Sachs and JPMorgan Chase, sent their own notices: JPMorgan told the Maine attorney general that 659 investors in a private equity fund were affected. So a letter about this incident can come from the firm or from a bank or fund manager that used it. The guide to why you got a breach letter from a company you never dealt with explains this pattern.

What information was exposed?

The data elements vary by person and appear in each letter; the filed sample has a blank where they go. The firm says it believes the copied data will not be distributed or used improperly, based on its actions, its outside experts' experience with this kind of group, and its ongoing monitoring. It also says there is no sign the third party targeted any one person's information. SecurityWeek noted that it had seen no ransomware group claim the attack.

How many people were affected?

46,602 in total, per Indiana's report, including 3,468 Indiana residents. The firm's letter gives no count. The largest data breaches of 2026 shows where it sits this year.

Texas's attorney general lists a report from Fried, Frank, Harris, Shriver & Jacobson LLP, posted on March 9, 2026, with 16,724 Texans affected. The Texas record lists names, addresses, Social Security numbers, driver's license numbers, other government ID numbers, financial account or card numbers, medical information, other information and dates of birth among the information involved. Of the 607 reports Texas posted in 2026 up to November 10, it is the 94th largest by Texans affected; the Texas ranking has the largest. The figure counts Texans only.

What is Fried Frank offering?

Two years of Equifax credit and identity monitoring at no cost, with fraud consultation and identity theft restoration. Activation is at equifax.com/activate with the code and deadline printed in each letter. The firm's call center is 1-855-815-4018, Monday to Friday, 9 a.m. to 9 p.m. Eastern. The guide to credit monitoring offers explains what a free credit freeze adds.

How does this compare with other law firm breaches?

The log also has Seyfarth Shaw, where documents were emailed out without any system being entered, and Greenberg Traurig. The guide to law firm breach notices compares how firms describe these incidents.

How many Washingtonians were affected by the Fried Frank breach?

Washington's attorney general lists a notice from Fried, Frank, Harris, Shriver & Jacobson LLP, reported on January 30, 2026, with a breach date of October 23, 2025 and 2,106 Washingtonians affected. The record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, full dates of birth, passport numbers and other information as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

What the record leaves open

• How the one account was compromised.
• Who the third party was; the letter describes "this unauthorized third party and similar groups" without naming them.
• How many clients' data was on the drive, and how many sent their own notices.