Social Engineering Hits Two Major Law Firms

Baker McKenzie and Troutman Pepper Locke reported separate social-engineering incidents in which employees disclosed sensitive legal documents to unauthorized people. The attackers did not appear to break into either firm’s systems; instead, they relied on deceptive but credible-looking communications to persuade employees to share files.

Key findings

• Baker McKenzie said an attacker socially engineered two users on August 14 and 17, 2026, obtaining a limited number of files.
• Troutman Pepper Locke said an employee responded to apparently legitimate communications and sent documents to an unauthorized person.
• The incidents reportedly affected 25,837 people at Baker McKenzie and 63,358 people at Troutman Pepper Locke.
• Neither notification found evidence that the recipient or attacker independently accessed the firms’ systems.
• The exposed information included Social Security numbers; Baker McKenzie also reported medical information.
• Both firms offered 24 months of credit monitoring or identity-protection services to affected individuals.

Who’s being targeted

• Commonly targeted roles: Legal staff, Paralegals, Administrative assistants, Records and document-management teams, Employees handling client personal information, IT security and incident-response teams.
• Affected industries: Legal services, Professional services.
• Attack channels: email.
• Impersonated: An apparently legitimate external business contact, An unspecified trusted requester.

Awareness takeaways

• Independently verify unusual requests for sensitive documents before sending them, especially when the request appears to come from a trusted contact.
• Use approval workflows and least-privilege sharing rules for confidential files so a single employee mistake cannot expose large amounts of personal information.
• Protect highly sensitive documents with recipient-specific access controls that can be revoked if a file is sent to the wrong person.
• Practice response procedures for misdirected-file incidents so employees know to report the mistake immediately and teams can contain the exposure.

Red flags to watch for

• The request seeks sensitive documents without an independent verification step.
• The recipient address or identity has not been confirmed through a known channel.
• The request creates pressure to share files outside normal authorization procedures.
• The request comes from a person whose identity has not been independently verified.
• The requested files contain personal or confidential information.
• The request bypasses recipient-specific authorization or approval controls.