A law firm trusted with some of the country’s most sensitive legal matters has now reported three separate data breaches since 2021. Goodwin Procter LLP, a major international law firm headquartered in Boston, has confirmed a new breach affecting personal information the firm held in connection with its legal work for clients.
Goodwin Procter confirmed to Law360 Pulse on June 29, 2026 that it experienced a data security breach in spring 2026. A Texas Attorney General filing published July 31, 2026 confirms at least 1,550 Texas residents were affected, with names and Social Security numbers exposed.
Law360 Pulse reported that this is Goodwin Procter’s third cybersecurity incident since the start of 2021. The firm previously disclosed a 2021 breach tied to a third-party file-transfer vendor, and an April 2025 incident involving a vendor called Commvault that affected 363 individuals and was disclosed in July 2025. Those two earlier incidents are separate, already-closed matters. A repeat pattern like this matters because law firms hold an unusually sensitive mix of information, litigation records, deal documents, and personal information belonging to people who may have never chosen to work with the firm directly.
Goodwin’s own notice letter explains that the firm received the affected personal information while providing legal advice to its clients. That means people receiving a notice may not be Goodwin’s own clients at all, they may be employees, opposing parties, witnesses, or other individuals whose information passed through the firm’s hands as part of a legal matter it handled.
Per the Texas Attorney General filing, the compromised information includes:
Goodwin’s own notice letter template does not spell out the specific data elements involved for each recipient either, individual letters reference a variable data-elements field filled in per person.
Goodwin is offering 24 months of complimentary credit monitoring and identity theft protection services through Equifax to affected individuals.
A Social Security number is one of the most directly usable pieces of information for identity theft, enabling new-account fraud and fraudulent tax filings. That risk doesn’t depend on whether the person affected ever hired Goodwin Procter themselves, their information reached the firm simply because it was relevant to a legal matter the firm was handling.
Law firms that receive personal information in the course of representing clients have the same legal duty to safeguard it as any other organization that collects sensitive data, and that duty doesn’t depend on whether the affected person is the firm’s own client.
How many people were affected by the Goodwin Procter data breach?
At least 1,550 Texas residents, per a Texas Attorney General filing published July 31, 2026. No national total has been disclosed.
Is this Goodwin Procter’s first data breach?
No. Law360 Pulse reported this is the firm’s third cybersecurity incident since 2021, following a 2021 vendor breach and an April 2025 incident tied to a vendor called Commvault.
What information was exposed?
Names, Social Security numbers, and an additional unspecified category of personal information, per the Texas AG filing.
Do I have a legal claim?
Organizations that collect Social Security numbers, including law firms handling other people’s information, have a legal duty to protect it and to notify affected individuals when that duty is breached. If you received a notice from Goodwin Procter, contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 for a Free Case Review.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
