Thompson Coburn LLP

Summary

A major U.S. law firm is preparing to settle a class-action lawsuit stemming from a data breach that occurred in May of the previous year, with the suit filed in mid-February. The incident exposed sensitive information and led to litigation alleging the firm failed to adequately protect client data. In response, the firm announced plans to promptly resolve the case, signaling an effort to mitigate further legal and reputational fallout. The breach adds to a growing trend of cybersecurity class actions targeting large law firms handling sensitive client information.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Thompson Coburn, an Am Law 100 law firm, became the subject of a class-action lawsuit filed on February 13, 2026, stemming from a data breach incident that occurred in May 2024. The lawsuit was reported in coverage of broader cybersecurity litigation trends affecting major law firms, where the firm was identified alongside Fried, Frank, Harris, Shriver & Jacobson as one of the latest legal industry targets for class-action claims related to cyber incidents. According to the available reporting, Thompson Coburn was preparing to promptly settle the lawsuit at the time the article was published on February 17, 2026, indicating that the firm had elected to resolve the matter through settlement rather than protracted litigation.

The underlying cybersecurity incident at Thompson Coburn occurred in May 2024, though specific technical details about the nature of the breach, the systems affected, the method of attack, or the timeline of discovery and containment are not detailed in the available source material. The breach served as the basis for the subsequent class-action complaint filed in February 2026, suggesting that affected individuals alleged harm or exposure of personal information as a result of the incident. The nearly two-year gap between the May 2024 breach and the February 2026 filing indicates a typical pattern for class-action litigation following data breach disclosures, where affected parties and their counsel investigate claims before formally filing suit.

The lawsuit was filed on February 13, 2026, approximately a week before the news coverage was published. Thompson Coburn's stated intention to settle the case promptly represents a response action by the firm, though the specific terms of any settlement, the monetary amount, or the remediation commitments to affected parties are not specified in the available reporting. The firm's decision to settle rather than defend against the claims in court suggests an acknowledgment of liability or a strategic decision to avoid the costs and reputational damage associated with continued litigation.

The broader context of the reporting placed Thompson Coburn within a growing list of major law firms facing cybersecurity-related class actions. Fried Frank, the other firm mentioned in the same article, was facing its second class-action lawsuit over a separate October 2025 cyber incident, highlighting a pattern of increasing cyber threats and litigation targeting the legal sector. The reporting characterized both firms as among the latest in the legal industry to encounter such legal challenges, suggesting that law firms handling sensitive client information have become attractive targets for threat actors seeking valuable data.

While the specific operational impacts on Thompson Coburn's practice, the number of affected clients or individuals, the types of data exposed, and the firm's internal response procedures are not detailed in the available source material, the decision to settle the class action implies a recognition by the firm that the breach had resulted in actionable claims from affected parties. The settlement approach also indicates an effort by the firm to resolve the matter efficiently and limit ongoing legal exposure. The available reporting does not provide information on whether regulatory notifications were issued, whether forensic investigations were conducted, or what specific security measures were implemented in the wake of the May 2024 incident.

Sources

Sources available to members: 1 source.