WilmerHale

Summary

WilmerHale experienced a data breach in which an unauthorized third party obtained a limited set of client personal information. The firm stated the incident was isolated and quickly contained, with no evidence that the data was misused or disclosed. Clients were notified that their information could have been accessed, and a putative class action lawsuit alleges negligence and seeks damages for the alleged failure to safeguard private information.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early May 2026, WilmerHale discovered a data breach involving client personal information. The firm determined that an unauthorized third party, which had been targeting law firms across the legal industry, obtained a limited set of information from the firm. WilmerHale stated that the hacker did not directly access its systems or network and that there was no evidence the information had been misused or disclosed. On July 10, 2026, the firm notified affected clients that their personal information could have been obtained by hackers. Four days later, on July 14, 2026, a putative class action lawsuit was filed in the United States District Court for the District of Columbia. The lawsuit, led by Jason Perry of Las Vegas who alleged he was a WilmerHale client, claims negligence and breach of contract on behalf of thousands of clients potentially impacted by the breach.

The complaint alleges that WilmerHale intentionally, willfully, recklessly, and/or negligently failed to implement adequate and reasonable measures to safeguard clients' private information. WilmerHale responded by issuing a statement expressing regret for the breach, describing it as isolated and quickly contained, and noting that it was enhancing firm security. The firm's spokesperson reiterated that the unauthorized third party had obtained only a limited set of information and that there was no evidence of misuse or disclosure. The case is captioned Perry v. Wilmer Cutler Pickering Hale & Dorr LLP, D.D.C., No. 1:26-cv-02470, with the complaint filed on July 14, 2026. Lead counsel for the plaintiff are Wise Law Firm and Cole & Van Note. The lawsuit adds to a series of similar data breach actions brought against other major law firms in the preceding year, including Blank Rome, Wiley Rein, Fried Frank, and Pillsbury Winthrop.

Sources

Sources available to members: 1 source.