A review of Texas Attorney General breach reports has identified 30 data security incidents involving law firms and legal service providers. These breaches have collectively exposed the personal information of 256,284 Texans.
While some of the affected firms are based outside of Texas, the incidents impacted Texas residents, triggering reporting requirements under Texas law. Data is current through Oct 6, 2026.
Texas Law Firm Breaches (2026)
Interactive Tracker
Texas Law Firm Breaches: 2026 OAG Reports
Texans affected by 2026 breach notices from law firms and legal-service providers, by month
Show largest 2026 law firm breach reports
| Entity | Published | Texans affected | Sector |
|---|---|---|---|
| Wilmer Cutler Pickering Hale and Dorr LLP | Aug 21, 2026 | 80,528 | Law |
| Sprouse Shrader Smith PLLC | May 5, 2026 | 17,666 | Law |
| Fried, Frank, Harris, Shriver & Jacobson LLP | Mar 9, 2026 | 16,724 | Law |
| Williams Hart & Boundas, LLP | Mar 18, 2026 | 7,844 | Law |
| Modjarrad & Associates, PC d/b/a MAS Law | Jun 1, 2026 | 6,220 | Law |
Source: Texas Attorney General - Data Security Breach Reports, industry-filtered. Data current through Oct 6, 2026.
Sources
State AG breach portals
State AG reporting & notices
Federal registries
Notable Texas Law Firm Notices
| Organization | Texans Affected | Date Published |
|---|---|---|
| Wilmer Cutler Pickering Hale and Dorr LLP | 80,528 | Aug 21, 2026 |
| Sprouse Shrader Smith PLLC | 17,666 | May 5, 2026 |
| Fried, Frank, Harris, Shriver & Jacobson LLP | 16,724 | Mar 9, 2026 |
| Williams Hart & Boundas, LLP | 7,844 | Mar 18, 2026 |
| Modjarrad & Associates, PC d/b/a MAS Law | 6,220 | Jun 1, 2026 |
Newly listed in Texas (last 3 weeks)
| Organization | Texans Affected | Date Published |
|---|---|---|
| Sheppard, Mullin, Richter & Hampton LLP | 2,326 | Oct 6, 2026 |
| Fragomen, Del Rey, Bernsen & Loewy, LLP | 379 | Oct 6, 2026 |
Largest Law Firm-Related Breaches (Aug 2025+)
Several major incidents stand out due to the high number of Texans affected:
Law-Firm / Legal-Service Breach Reports
A filtered review of the Texas OAG Data Security Breach Reports database found likely law-firm or legal-service entities in published breach notices from Aug 1, 2025 through Oct 6, 2026.
Largest Reported Breaches
All Listed Law-Firm / Legal-Service Entries
| Law Firm / Legal Entity | Location | Texans Affected | Date Published |
|---|---|---|---|
| Williams Hart & Boundas, LLP | Houston, Texas | 334 | Sep 22, 2025 |
| Mehri & Skalet, PLLC | Washington, DC, District of Columbia | 505 | Oct 27, 2025 |
| Thompson & Horton LLP | Houston, Texas | 41,222 | Oct 30, 2025 |
| Pillsbury Winthrop Shaw Pitman LLP | Los Angeles, California | 39,573 | Nov 7, 2025 |
| Mehri & Skalet, PLLC | Washington, District of Columbia | 3,210 | Nov 21, 2025 |
| TorHoerman Law, LLC | Edwardsville, Illinois | 710 | Dec 19, 2025 |
| Herrman & Herrman PLLC | Dallas, Texas | 13,424 | Dec 22, 2025 |
| Foley & Lardner LLP | Milwaukee, Wisconsin | 876 | Dec 29, 2025 |
| The Reecer Law Firm PLLC | Denton, Texas | 897 | Jan 27, 2026 |
| Wisner Baum LLP | Los Angeles, California | 3,154 | Jan 27, 2026 |
| Fried, Frank, Harris, Shriver & Jacobson LLP | New York, New York | 16,724 | Mar 9, 2026 |
| Gearhiser, Peters, Elliott & Cannon, PLLC | Chattanooga, Tennessee | 3,717 | Mar 17, 2026 |
| Williams Hart & Boundas, LLP | Houston, Texas | 7,844 | Mar 18, 2026 |
| Law Office of Michael R. De La Paz | San Antonio, Texas | 2,000 | Apr 13, 2026 |
| Rodenburg Law Firm | Fargo, North Dakota | 606 | Apr 24, 2026 |
| Martin & Cukjati, LLP | San Antonio, Texas | 897 | May 5, 2026 |
| Sprouse Shrader Smith PLLC | Amarillo, Texas | 17,666 | May 5, 2026 |
| Berger & Williams, LLP | San Diego, California | 312 | May 6, 2026 |
| Dykema Gossett PLLC | Detroit, Michigan | 6,132 | May 28, 2026 |
| Modjarrad & Associates, PC d/b/a MAS Law | Richardson, Texas | 6,220 | Jun 1, 2026 |
| Tarter Krinsky & Drogin LLP | New York, New York | 325 | Jun 9, 2026 |
| The Carlson Law Firm | Killeen, Texas | 250 | Jun 18, 2026 |
| The Law Offices of Rakesh Mehrotra | Reston, Virginia | 1,029 | Jul 10, 2026 |
| Ernst & Young LLP | New York, New York | 873 | Jul 17, 2026 |
| Goodwin Procter LLP | Washington, District of Columbia | 1,550 | Jul 31, 2026 |
| Bahrie Law, PLLC | Lansing, Michigan | 301 | Aug 14, 2026 |
| The Law Office of Douglas D. Ketterman, P.L.L.C. | San Antonio, Texas | 2,700 | Aug 14, 2026 |
| Wilmer Cutler Pickering Hale and Dorr LLP | Washington, District of Columbia | 80,528 | Aug 21, 2026 |
| Fragomen, Del Rey, Bernsen & Loewy, LLP | Matawan, New Jersey | 379 | Oct 6, 2026 |
| Sheppard, Mullin, Richter & Hampton LLP | Los Angeles, California | 2,326 | Oct 6, 2026 |
Primary data: Texas OAG Data Security Breach Reports. Entities filtered as likely law firms/legal services by organization name. Data current through Oct 6, 2026. The OAG does not consistently identify attack methods.
Sources
State AG breach portals
State AG reporting & notices
Federal registries
Breach databases & aggregators
News & analysis
These five incidents alone account for a significant portion of the total Texans impacted by law firm-related breaches.
Washington Law Firm Breaches (2026)
No Washington AG breach notices in our current dataset matched law-firm or legal-service entity filters for 2026. Monitor the Washington AG breach notifications page for new filings.
Notable Washington Law Firm Notices
| Organization | Washingtonians Affected | Date Published |
|---|---|---|
| Wilmer Cutler Pickering Hale and Dorr LLP | 17,253 | Jul 15, 2026 |
California AG List (No Affected Counts)
California publishes incident names without resident totals. 13 likely law-firm or legal-service entries were reported in 2026 through Oct 2, 2026:
- Sheppard, Mullin, Richter & Hampton LLP — Oct 2, 2026
- Fragomen, Del Rey, Bernsen & Loewy, LLP — Oct 2, 2026
- Tarter Krinsky & Drogin LLP — Sep 15, 2026
- Ernst & Young LLP — Jul 15, 2026
- Wilmer Cutler Pickering Hale and Dorr LLP — Jul 10, 2026
- Rodenburg Law Firm — Jul 2, 2026
- Pearlman, Brown & Wax LLP — Jun 9, 2026
- Fong, Ko & Associates LLP — Jun 1, 2026
- Berger & Williams, LLP — May 5, 2026
- Dubroff, Easley, & Lovell, LLP — Mar 25, 2026
- Fried, Frank, Harris, Shriver & Jacobson LLP — Mar 6, 2026
- Fried, Frank, Harris, Shriver & Jacobson LLP — Jan 30, 2026
- Wisner Baum LLP — Jan 23, 2026
Why Law Firms Are Being Targeted
Law firms are attractive targets for cybercriminals because they hold highly sensitive client data, including:
- Financial and banking information
- Personal identifying information (SSNs, driver’s licenses)
- Medical records
- Privileged attorney-client communications
A breach at a law firm can have serious consequences, including potential violations of professional responsibility rules and loss of client trust.
Key Observations
- 28 unique law firms/legal entities have been impacted
- Multiple firms appear more than once in the reports (e.g., Mehri & Skalet, PLLC and Williams Hart & Boundas, LLP)
- Breaches span from August 2025 through Oct 6, 2026
- Both large national firms and smaller regional firms have been affected
Recommendations for Texas Law Firms
Given the rising number of incidents, Texas law firms should prioritize the following:
- Conduct regular cybersecurity risk assessments
- Implement multi-factor authentication across all systems
- Review and strengthen vendor and third-party risk management
- Provide ongoing security awareness training for all staff
- Maintain a documented and tested incident response plan
Related trackers
- Texas OAG YTD dashboard
- Washington law firm breaches (2026)
- Healthcare AG breach tracker
- Financial services tracker
- Hospitality & retail tracker
- Washington healthcare breaches (2026)
- CA October roundup
- TX October roundup
- WA September roundup
- TX Parks breach
- Have I Been Pwned
- HIBP September roundup
- Breach data week (October)
- HHS OCR September roundup
- SEC 8-K September roundup
- Monitoring guide
- All trackers