Holland & Knight Data Breach

Holland & Knight, a large national law firm, has reported a data breach involving Social Security numbers. The firm said an attacker used social engineering to get remote access to one of its computers and took a small number of files.

What Holland & Knight Has Reported

Holland & Knight LLP is a large U.S. law firm with offices across the country. On October 8, 2026, the firm’s breach notice appeared on the Vermont Attorney General’s security breach list. The entry lists one Vermont resident and Social Security numbers as the information involved.

In early September, the firm described a cyber incident to reporters. According to Non-Billable, Holland & Knight said an attacker used social engineering to gain unauthorized remote access to a firm computer. The firm said a “small number of files” were involved, affecting 14 clients, and that those clients had been notified. The firm also said it contacted law enforcement and that its systems stayed fully operational.

How the Attack Worked

Social engineering means tricking a person instead of breaking through technology. Holland & Knight said the group behind its incident has targeted other law firms using similar tactics. Cyber intelligence websites attributed the attack to Silent Ransom Group, Non-Billable reported. Holland & Knight has not publicly named the group.

The FBI has warned law firms about Silent Ransom Group more than once, most recently in May 2026. According to CyberScoop, the group calls or emails employees while posing as IT support, gets them to allow remote access to their computer, and then copies data and threatens to publish it unless a ransom is paid. The group focuses on stealing data rather than locking systems.

What Is Still Unknown

Several important facts have not been made public:

• When the incident happened and when the firm discovered it
• How many people’s information was involved in total
• Whether the Vermont filing covers the same incident the firm described in September
• Whether the firm is offering credit monitoring

The firm’s figure of 14 clients is a count of clients, not people. A single client file can contain information about many individuals, such as employees, family members or other people named in a legal matter.

What Information Was Exposed?

According to the Vermont Attorney General’s list, the information involved includes:

• Social Security numbers

The notice letter itself has not been made public. Each person’s letter should list the specific information involved for them.

How Many People Were Affected?

Holland & Knight has not disclosed a total. The Vermont filing lists one Vermont resident, which reflects only one state and is not a measure of the total.

What Is Holland & Knight Offering?

No public filing describes what, if anything, Holland & Knight is offering affected people, such as credit monitoring. People who received a letter should check it for any enrollment code and deadline.

Your Information Is at Risk

A Social Security number is one of the most valuable pieces of information a criminal can get. It can be used to open credit cards and loans, file a false tax return, or apply for benefits in another person’s name. Unlike a password or a card number, a Social Security number usually cannot be changed, so the risk can last for years after a breach.

Data taken from a law firm can be especially sensitive, because legal files often hold financial records, personal histories and details people expected to stay confidential. Groups that steal law firm data have also been reported to use it to pressure victims, which can lead to targeted scams.

Do You Have Legal Options?

Law firms collect some of the most sensitive information people share, including Social Security numbers, financial records and details of legal matters, and they have a duty to protect it and to notify people promptly when it is exposed. When that obligation is not met, affected individuals may have legal rights and remedies worth discussing with an attorney. Emery | Reddy is investigating this incident on behalf of people who received a notice letter.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Frequently Asked Questions

Did Holland & Knight have a data breach?

Yes. In September the firm said an attacker gained remote access to a firm computer and took a small number of files, and its breach notice was posted by the Vermont Attorney General on October 8, 2026.

How many people were affected?

The firm has not said. It reported that the files it described affected 14 clients, and Vermont lists one resident. Neither number is a total count of people.

What information was exposed?

According to the Vermont filing, the information includes:

• Social Security numbers

Check your own letter for the full list of what was involved for you.

Who was behind the attack?

Holland & Knight said it was a group that has targeted other law firms. Cyber intelligence websites attributed the attack to Silent Ransom Group, according to Non-Billable. The firm has not publicly named the group.

How do I protect myself from scams that mention the breach?

Criminals often call, text or email people after a breach and mention the company by name so they seem real. Groups that target law firms have also been reported to contact a firm’s clients directly to apply pressure. Do not click links, download software or give information to anyone who contacts you about the Holland & Knight breach. If you are unsure, hang up and call the firm or your attorney at a number you already know.

What should I do if I received a letter?

Take these steps:

• Read your letter closely and enroll in any monitoring it offers by the deadline
• Place a free credit freeze with Equifax, Experian and TransUnion
• Review your credit reports and bank statements for activity you do not recognize
• Be cautious of calls or emails that mention the breach
• Keep your letter

Do I have a legal claim?

You may. Law firms collect some of the most sensitive information people share, including Social Security numbers, financial records and details of legal matters, and they have a duty to protect it and to notify people promptly when it is exposed. If you received a Notice of Data Breach letter from Holland & Knight, contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.