Two major law firms have told clients that their data was caught up in an attack that targeted people rather than software. Holland & Knight and Squire Patton Boggs disclosed breaches in October 2026, notifying 14 clients after a social-engineering attack. The case is a useful reminder of how a law firm data breach social engineering incident works, and of what the clients on the receiving end can do about it.

The source reporting is brief, so this post sticks to what has been confirmed and explains the general mechanics of this kind of attack. It does not speculate about what data was taken or who was behind it.

What Holland & Knight and Squire Patton Boggs Disclosed

According to the reporting, both firms disclosed security incidents in October 2026. Between them, 14 clients were notified. The cause was described as a social-engineering attack.

The source does not detail what types of information were exposed, how long attackers had access, or how the deception was carried out. Until the firms or regulators publish more, those questions remain open. If you are a client of either firm, the notification you receive is the authoritative source for what applies to you.

How Social Engineering Gets Past Law Firm Defenses

Social engineering means tricking a person into doing something that helps an attacker, such as sharing a password, approving a login prompt, opening a file, or handing over information. It does not need to defeat a firewall or exploit a software flaw. It only needs one convincing message to reach one busy employee.

That is why technical defenses alone have limits. Encryption, network monitoring, and access controls all assume that the people holding the keys use them correctly. An attacker who impersonates a colleague, a client, or an IT help desk can sometimes sidestep those controls by asking a legitimate user to open the door.

Common defenses organizations rely on include:

  • Phishing-resistant multi-factor authentication, such as hardware security keys
  • Verification procedures for unusual requests, like calling back on a known number
  • Limiting who can access which client files
  • Regular staff training and simulated phishing exercises

No single measure is foolproof, which is why layered controls matter.

Why Client Data at Professional Services Firms Is Exposed

Law firms hold a concentrated mix of information: contracts, financial records, personal details, and correspondence tied to their clients. That makes them an attractive place to look, because one successful intrusion can touch many clients at once.

From a client's perspective, there is also a trust gap. You choose a firm for its expertise and discretion, but you rarely see its internal security practices. Your data is only as safe as the habits of the people who handle it, and you have little control over those habits. The disclosures from these two firms show that even large, well-resourced organizations can be affected when one deception works.

What This Means For You

If you are one of the 14 notified clients, read your notice carefully and follow any instructions it gives. If you are not, the same principles apply to any firm, bank, or provider that holds your information.

A few practical steps:

  • Treat follow-up messages with suspicion. After a breach, attackers sometimes pose as the affected organization. Do not click links in unexpected emails or texts about the incident. Contact the firm using a phone number or address you already trust.
  • Review your credential hygiene. Use a unique password for every account, store them in a password manager, and turn on multi-factor authentication wherever it is offered. If you reused a password anywhere connected to this relationship, change it.
  • Ask what was exposed. Clients have every right to ask a firm what data was involved and what it is doing to prevent a repeat.
  • Enable breach-notification monitoring. Many browsers, password managers, and credit services can alert you when your email address or other details appear in a known breach.
  • Watch your accounts. Keep an eye on financial statements and unusual login alerts for the coming months.

For a broader look at the steps to take when personal data is caught up in a large incident, see our coverage of the Carnival Corporation data breach, which affected roughly 6 million people.

The Bottom Line

The Holland & Knight and Squire Patton Boggs disclosures show that a law firm data breach social engineering attack does not need advanced malware to reach sensitive client information. It needs a convincing pretext and a person willing to trust it. Firms carry the main responsibility for training staff and building verification into their routines, but clients are not powerless.

Start today: audit your passwords, turn on multi-factor authentication, set up breach alerts, and be wary of any message that references these incidents. Those small habits limit the damage if someone else's employee is fooled.