Hackers stole 3.9 million records from LexisNexis's cloud infrastructure in a breach disclosed in February 2026, according to confirmed reporting from BleepingComputer, exposing plaintext credentials and profile data tied to roughly 400,000 user accounts. More than 100 of those accounts carried .gov email addresses belonging to federal judges, law clerks, Department of Justice attorneys, and SEC staff. It was the second major legal-data-services breach in fifteen months, following a separate LexisNexis Risk Solutions incident that exposed Social Security numbers for over 364,000 people in 2025.
How many records have leaked from law firms and legal-services vendors?
Four confirmed breaches at law firms and legal-data companies between 2023 and 2026 together exposed the personal information of more than 1.7 million people. The pattern spans both ends of the industry: a global Am Law 100 firm, a mid-size litigation firm, and the two largest breaches at the data-services companies law firms rely on for case research and background checks.
Figure 1: Largest confirmed legal-sector data breaches, 2023 to 2026, by individuals or user accounts affected. Sources: HIPAA Journal, Bloomberg Law, TechCrunch, BleepingComputer (see Sources section).
Orrick, Herrington & Sutcliffe, an international law firm with more than 1,100 attorneys, disclosed a ransomware attack on March 13, 2023. The firm initially notified roughly 153,000 people, then revised that figure upward as its investigation continued, ultimately notifying 638,023 people that their data had been accessed and exfiltrated. A federal judge in the Northern District of California granted final approval to an $8 million class settlement in November 2024. Houser LLP, a smaller firm, settled a separate 2023 breach affecting more than 326,000 people for $1.3 million in 2025. Neither settlement is unusual anymore: insurance carriers disclosed comparably sized breaches in the same window, often traced to the same class of social-engineering and third-party-vendor attacks.
Why is ransomware surging against law firms?
BakerHostetler's 2026 Data Security Incident Response Report, based on more than 1,250 data-security incidents the firm worked in 2025, found ransomware deployed in 27% of all cases, with phishing the leading entry point at nearly a third of breaches and third-party vendors involved in another 25%. The report's authors describe attacks against law firms as "nearly doubling" over the prior year.
Figure 2: Ransomware as a share of the 1,250-plus security incidents BakerHostetler's clients worked through in 2025. Source: BakerHostetler 2026 Data Security Incident Response Report.
Ransom economics shifted sharply in the same period. The average initial demand against BakerHostetler's clients rose 70% to $4.2 million, while the average amount actually paid rose 36% to $682,702, a gap that suggests firms are negotiating harder rather than paying the opening number. Jones Day, one of the world's largest law firms by revenue, experienced this firsthand in April 2026: the Silent Ransom Group, a group the FBI has separately warned targets law firms specifically, gained access through a phishing attack and demanded $13 million after obtaining files for 10 of the firm's clients. Jones Day confirmed the limited breach and notified every affected client.
How often do law firms get breached in the first place?
29% of law firms report having experienced a security breach at some point in their history, according to the American Bar Association's 2025 Cybersecurity TechReport, with firms of 10 to 49 attorneys, large enough to hold valuable client data but often without a dedicated security team, reporting the highest incident rates of any firm size.
Figure 3: Share of law firms reporting at least one security breach, all firm sizes. Source: American Bar Association 2025 Cybersecurity TechReport.
That 29% figure covers self-reported breaches of any size and severity, from a single stolen laptop to a full ransomware encryption event. Once a firm handling any consumer-facing intake, whether a solo practitioner's client portal or a large firm's public website, collects personal information, the same disclosure obligations that apply to any other business apply to it too: you can generate a privacy policy that spells out what client and prospective-client data you collect and how a breach would be handled.
What data was exposed, and what does a law firm have to do about it?
LexisNexis's February 2026 breach began on February 24, when a threat actor identifying itself as FulcrumSec exploited React2Shell, a critical remote-code-execution flaw in an unpatched React frontend application, to reach hundreds of Redshift and VPC database tables inside LexisNexis's AWS environment. LexisNexis confirmed the breach to BleepingComputer on March 3, 2026, after the attacker began publicizing stolen files, and said the exposed data included customer names, user IDs, business contact information, and support tickets, but not Social Security numbers, driver's license numbers, or active passwords. The separate 2025 LexisNexis Risk Solutions breach was different in kind: an unauthorized party accessed a GitHub repository used for software development on December 25, 2024, and that incident did expose Social Security numbers and driver's license numbers for more than 364,000 people.
Figure 4: The overlapping duties a law firm works through after confirming a breach. Source: ABA Model Rule 1.6(c) safeguarding duty, as applied in BakerHostetler's 2026 Data Security Incident Response Report methodology notes.
The distinction matters for how a firm responds. ABA Model Rule 1.6(c) requires lawyers to make reasonable efforts to prevent unauthorized access to client information, and a breach involving privileged material triggers a client-notification duty that sits on top of, not instead of, the state breach-notification laws that apply to any business. A firm handling both categories of data at once, as most do, ends up managing two overlapping compliance clocks simultaneously.
Figure 5: Milestone legal-sector data breaches, 2023 to 2026. Sources: Bloomberg Law, HIPAA Journal, TechCrunch, BleepingComputer, DataBreaches.Net.
Major legal-sector data breaches, 2023 to 2026
| Entity | Individuals affected | Year disclosed | Data type |
|---|---|---|---|
| Orrick, Herrington & Sutcliffe | 638,023 | 2023 (revised through 2024) | Names, SSNs, financial data |
| LexisNexis (AWS, React2Shell) | ~400,000 user accounts | 2026 | Credentials, business contact data |
| LexisNexis Risk Solutions | 364,000+ | 2025 (breach dated Dec 2024) | SSNs, driver's license numbers |
| Houser LLP | 326,000+ | 2023 (settled 2025) | Personal and financial information |
| Jones Day | 10 clients | 2026 | Client files, exact scope undisclosed |
The Bottom Line
Legal-sector data handling has two attack surfaces now, not one: the law firm itself, where 29% of firms report a breach history and ransom demands are up 70% year over year, and the data-services companies firms rely on for research and case management, where a single cloud misconfiguration at LexisNexis exposed federal judges' account data alongside everyday customer records. Privileged material adds a compliance layer general counsel at other industries do not carry, since a breach can trigger both a state notification deadline and a professional-conduct obligation under rules like ABA Model Rule 1.6(c) at the same time. Whether you run a solo practice or a large firm, the baseline defense is the same one every business needs: know what client and prospective-client data your intake forms and website actually collect, and say so in a policy that is current enough to survive a regulator's or a plaintiff's first question.
Frequently Asked Questions
What is the largest confirmed legal-sector data breach? The February 2026 breach of LexisNexis's cloud infrastructure, in which a threat actor exploiting the React2Shell vulnerability exfiltrated 3.9 million records, including plaintext credentials and profile data tied to roughly 400,000 users, per BleepingComputer's confirmed reporting. More than 100 of those accounts carried .gov email addresses belonging to federal judges, law clerks, DOJ attorneys, and SEC staff.
How many law firms have experienced a data breach? 29% of law firms report having experienced a security breach at some point, according to the American Bar Association's 2025 Cybersecurity TechReport. Firms with 10 to 49 attorneys reported the highest incident rates of any firm size.
How much do ransom demands against law firms cost? The average initial ransom demand against BakerHostetler's law-firm and corporate clients rose 70% year over year to $4.2 million in 2025, while the average amount actually paid rose 36% to $682,702, per the firm's 2026 Data Security Incident Response Report, based on more than 1,250 incidents it handled that year.
What happens after a law firm's data is breached? 56% of law firms that experienced a breach in the past year lost sensitive client information, per BakerHostetler's 2026 report. Firms then face overlapping duties: assessing whether privileged material was exposed, notifying affected clients under ABA Model Rule 1.6, and meeting state breach-notification deadlines, which run independently of any bar-specific ethics obligation.
Where the Numbers Come From
- BleepingComputer. (2026). "LexisNexis confirms data breach as hackers leak stolen files." 3.9 million records, roughly 400,000 user accounts, breach dated February 24, 2026, confirmed March 3, 2026.
- TechCrunch. (2025). "Data broker giant LexisNexis says breach exposed personal information of over 364,000 people." LexisNexis Risk Solutions, breach dated December 25, 2024, disclosed May 2025.
- HIPAA Journal. "Orrick, Herrington & Sutcliffe Agree $8 Million Settlement to Resolve Class Action Data Breach Lawsuit." 638,023 individuals notified, breach dated March 13, 2023, settlement approved November 2024.
- ClassAction.org. "Orrick, Herrington and Sutcliffe Hit with Class Action Over Data Breach Affecting 152K." Initial notification figure, later revised upward through the litigation.
- Maryland State Bar Association. "Law Firm Settles Data Breach Lawsuit: A Warning for Legal Professionals." Houser LLP, more than 326,000 individuals, 2023 breach settled 2025.
- DataBreaches.Net. (2026). "Jones Day confirms limited breach after phishing attack by Silent Ransom Group." 10 clients affected, $13 million ransom demand, disclosed April 2026.
- American Bar Association. (2025). "2025 Cybersecurity TechReport." 29% of law firms report having experienced a security breach; highest incident rate among firms with 10-49 attorneys.
- BakerHostetler. (2026). "2026 Data Security Incident Response Report." More than 1,250 incidents worked in 2025; 27% involved ransomware; 56% of breached firms lost client data; average initial demand $4.2 million (+70%); average payment $682,702 (+36%).
Note: All figures verified as of September 2026. The LexisNexis February 2026 incident's full scope draws in part on the threat actor's own disclosure alongside LexisNexis's confirmation to BleepingComputer, and may be revised as the company's investigation continues. This post will be refreshed at least twice a year to track new breach disclosures and updated ABA and BakerHostetler survey editions.
