Social engineering attacks exposed sensitive legal files at two major law firms, without evidence that the attackers independently accessed their systems.
Baker McKenzie and Troutman Pepper Locke reported separate incidents in August 2026 involving documents containing personal information. Texas regulatory filing summaries released in October list 25,837 affected people at Baker McKenzie and 63,358 at Troutman, totaling nearly 90,000 reported cases across the two incidents.
The disclosures expose the risks of relying on employees to recognize deceptive requests. Karim Eldefrawy, PhD, co-founder and chief technology officer at Confidencial, said, "A human mistake should encounter additional technical controls before it becomes a material data disclosure."
How attackers obtained the legal files
Baker McKenzie said an attacker socially engineered two users on August 14 and 17, obtaining a limited number of files. In its breach notification, the firm reported no evidence of compromised credentials, additional account compromise or independent malicious system access.
A summary of its Texas filing lists 25,837 affected individuals, including 831 Texas residents. Reported data categories include Social Security numbers and medical information.
Troutman reported a separate attack on August 7. An employee responded to apparently legitimate communications and mistakenly sent documents to an unauthorized person before alerting the firm's IT security team.
According to Troutman's notification, the recipient did not access its systems, and operations were unaffected. A summary of its October 30 Texas filing reports 63,358 affected individuals, including 4,194 Texas residents. The information involved included names and Social Security numbers.
Both firms engaged cybersecurity specialists, notified law enforcement and offered affected individuals 24 months of complimentary credit monitoring or identity protection.
The exposure also raises concerns about third-party data protection. An unrelated contractor malware incident involving millions of records illustrates how third-party security incidents can put sensitive information at risk, even without confirmed data theft.
Neither firm's notification identifies an attacker or establishes a connection between the incidents.
Controls that limit document exposure
Attackers can exploit trusted communications and business workflows to obtain confidential information without independently compromising corporate systems.
Eldefrawy recommended protecting sensitive documents through encryption and recipient-specific authorization. Separating document access, decryption rights and sharing permissions can limit exposure if files are misdirected or stolen.
Organizations can strengthen their defenses through five measures:
- Verify sensitive requests: Confirm unusual transfers through independent channels and require approval for high-risk disclosures.
- Restrict access and sharing: Apply least-privilege permissions and additional authorization for sensitive actions.
- Protect confidential documents: Classify files and use encryption, recipient-specific authorization and revocable access controls.
- Monitor data transfers: Use data loss prevention controls to detect bulk downloads and unauthorized sharing.
- Test incident response plans: Rehearse employee deception and misdirected-file scenarios, including containment, evidence preservation and notification.
Eldefrawy cautioned that compromised sessions could undermine encryption if attackers also gained unrestricted decryption rights. Microsoft 365 phishing campaigns involving authenticated accounts illustrate the need for continued monitoring and authorization checks after login.
Suspending future decryption can restrict additional exposure, although information already disclosed in plaintext cannot be cryptographically recalled. Controlling who can open, decrypt and share confidential files helps contain the damage when employee deception succeeds.
Read more: Attackers are also exploiting legal authority in a fake federal court phishing campaign with a reported potential reach of more than 100,000 companies.