Seyfarth Shaw has disclosed a data breach in which an attacker impersonating the law firm’s IT help desk persuaded an employee to send client documents containing personal information to an unauthorised email account.
The Chicago-founded firm notified authorities in California and Texas after determining that a limited number of documents had been acquired by an outside party.
Seyfarth said the August 18 incident resulted from a targeted social-engineering attack rather than an intrusion into its computer network. According to the firm, an individual posing as a member of its IT help desk deceived a single employee into emailing documents to an external account.
The firm said its security controls prevented the attacker from gaining access to Seyfarth’s network or systems. Its investigation found the incident was limited to the small number of documents sent by email.
A notification to the Texas Attorney General said the information involved included names and Social Security numbers. In its California notification, Seyfarth said the personal information had originally been obtained in connection with legal services performed by the firm.
That makes the incident particularly relevant to the legal sector. Law firms can hold sensitive personal and commercial information belonging not only to their own employees but also to clients and individuals whose details appear in documents handled during legal matters.
The breach also demonstrates the limits of relying solely on technical Managed IT for Law Firms: Security and Downtime Benefits. Social-engineering attacks target individuals rather than software vulnerabilities, attempting to persuade employees to disclose information or perform actions that bypass established safeguards.
For law firms, an incident involving client material can raise issues extending beyond statutory breach-notification requirements. Lawyers and firms also operate under UKJT AI Liability Statement — Lawyer Monthly concerning Law Firm Reputation Management | Lawyer Monthly making the handling and transmission of sensitive documents an important part of information-security compliance.
Seyfarth employs more than 1,000 lawyers across 14 offices in major US cities and is particularly known for management-side labour and employment work and its real-estate practice.
Its disclosure comes amid a rise in cybersecurity incidents affecting the legal profession. BakerHostetler reported earlier this year that its digital-assets and data-management teams responded to nearly 60 law-firm incidents during 2025, almost twice the number reported the previous year.
Greenberg Traurig is also facing proposed class actions following a separate breach involving personal information. Other firms including Quinn Emanuel, McDermott, Goodwin Procter and Herbert Smith Freehills have recently disclosed cybersecurity incidents, while WilmerHale has faced litigation following an alleged data-security breach.
For legal businesses, social engineering creates a different control problem from conventional hacking. Network protections may successfully prevent an attacker entering internal systems while sensitive information can still leave the organisation if an employee is persuaded to transmit it.
Verification procedures therefore become particularly important. Requests involving client documents, changes to communication channels or instructions apparently coming from internal IT teams may require independent confirmation before information is sent outside a firm.
The Seyfarth incident also illustrates why breach-response procedures must extend beyond identifying whether a network has been compromised. Firms may need to establish exactly which documents were transferred, what personal information they contained, whose information was affected and which regulatory notification requirements apply.
Seyfarth’s disclosure shows that strong network security cannot eliminate the human element of cybersecurity risk. For law firms holding confidential client information, technical controls, staff awareness and verification procedures increasingly need to operate as part of the same information-security framework.