Cyber Incident Victim: Goodwin Procter
Date:
Jan 2021
Location:
United States of America
Summary
A law firm experienced an indirect security breach through a third-party vendor providing large file transfer services, potentially exposing confidential client information for a small percentage of clients. The incident involved unauthorized access to data via the vendor's compromised systems, with subsequent updates confirming the vendor as Accellion following its broader breach impacting multiple organizations. The firm's investigation remained ongoing at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Goodwin Procter experienced a security incident involving unauthorized access to client data through a third-party vendor providing large file transfer services, as disclosed in an internal memo reviewed by Reuters on January 20, 2021. The firm's ongoing investigation determined that a "small percentage" of clients might have had confidential information accessed or acquired without authorization. Managing partner Mark Bettencourt communicated these findings to stakeholders on the same date, though the firm did not publicly identify the compromised vendor or specify the exact data types exposed. The breach timeline suggests the incident occurred on or around January 1, 2021, based on the article's contextual dating. Goodwin Procter initiated its investigation following notification from the affected vendor, though the memo did not detail technical aspects of the intrusion, containment procedures, or forensic methodologies employed.
The incident's scope remained undefined beyond the confirmed exposure of some client confidential information, with no disclosure of affected client counts or geographic impacts. While the article initially noted uncertainty regarding vendor attribution, an update indicated the breach likely stemmed from a separate Accellion security incident disclosed in January 2021 that affected multiple law firms. Goodwin Procter did not independently verify this connection in their official communications. The firm maintained operational continuity without reported service disruptions, focusing on client notifications and investigative coordination with the vendor. No subsequent public updates regarding remediation efforts, regulatory notifications, or legal consequences were documented in the source material.