Baker McKenzie, Squire Patton Boggs Class Action: Data Breach Lawsuits Filed

• Proposed class action lawsuits have been filed against Baker McKenzie and Squire Patton Boggs.
• Plaintiffs allege cyberattacks at both law firms led to the exposure of their personal information.
• Baker McKenzie reported a social engineering attack in August that compromised a limited number of files.
• Squire Patton Boggs disclosed an October breach where an unauthorized third party obtained a limited set of information.
• The lawsuits were filed in the Northern District of Illinois and the Northern District of Ohio, respectively, on a recent Wednesday.

The proposed class action lawsuits against both Baker McKenzie and Squire Patton Boggs underscore the significant and growing litigation risk for law firms and other organizations handling sensitive client data.

Two prominent legal organizations, Baker McKenzie and Squire Patton Boggs, are now confronting proposed class action lawsuits following alleged cyber incidents that purportedly resulted in the exposure of personal information belonging to plaintiffs. These legal challenges highlight the increasing scrutiny on data security within the legal sector, particularly concerning the sensitive client data managed by large law firms. The complaints, filed on a recent Wednesday, mark a significant development in the ongoing discussion surrounding cyber incident class action risk and law firm data security liability.

The legal action against Baker McKenzie was initiated in the Northern District of Illinois. Concurrently, a separate but similar complaint targeting Squire Patton Boggs was lodged in the Northern District of Ohio. Both lawsuits claim that security vulnerabilities at the respective firms led to unauthorized access and the potential compromise of individuals' private data, setting the stage for complex cyberattack litigation. The filing of these proposed class actions underscores the evolving standards of care expected from organizations entrusted with personal information.

Baker McKenzie publicly acknowledged a cyber incident last week, preceding the November 6, 2026, report, revealing that a cybercriminal successfully executed a social engineering attack in August. This sophisticated tactic involved manipulating two of the firm's users, ultimately leading to the acquisition of a limited number of files. Despite this breach, the firm maintained that there was no independent malicious access to its broader system, suggesting the compromise was contained to the specific files obtained through the social engineering vector. This incident brings to the forefront the social engineering attack legal implications for organizations.

Squire Patton Boggs, for its part, disclosed its own data breach in October. The firm reported that an unauthorized third party managed to obtain a limited set of information from its systems. While the specifics of the method of intrusion were not detailed in the same manner as Baker McKenzie's, the outcome was similar: a compromise of data held by the firm. Both incidents, though differing in their technical execution, have now culminated in legal challenges centered on the alleged failure to adequately protect personal data.

The proposed class action lawsuits against both Baker McKenzie and Squire Patton Boggs underscore the significant and growing litigation risk for law firms and other organizations handling sensitive client data. These cases serve as a stark reminder for legal professionals and compliance officers to rigorously review their data security protocols and incident response plans. The allegations of personal information exposure, even if limited, can lead to substantial legal and reputational consequences, emphasizing the need for robust cybersecurity measures.

Neither Baker McKenzie nor Squire Patton Boggs provided a response to requests for comment from Reuters regarding the newly filed lawsuits. This silence, while common in the early stages of litigation, leaves many questions unanswered about the full scope of the breaches, the number of individuals affected, and the specific types of personal information that may have been compromised. The ongoing Baker McKenzie data breach lawsuit and Squire Patton Boggs cyberattack litigation will likely set precedents for how law firms are held accountable for data security in the future.

This development underscores the significant and growing litigation risk for law firms and other organizations handling sensitive client data, particularly in the wake of cyber incidents like social engineering attacks. Lawyers and compliance officers should review their data security protocols, incident response plans, and insurance coverage to mitigate potential class action exposure and understand the evolving standards of care in protecting personal information.

Source: Original reporting via Reuters.