Summary
- Environment: Files held for client legal services
- Operational impact: Firm reports containment and no independent malicious system access
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed October 30, 2026; updated as evidence emerges.
What happened
Baker McKenzie says an attacker socially engineered two users on August 14 and 17, 2026 and obtained a limited number of files connected with legal services. [1]
Impact
The firm identified personal information in affected files, but the public template redacts the specific fields. It reports no evidence that credentials or additional user accounts were compromised and says there was no independent malicious access to its systems. [1]
Timeline
First reported social-engineering event
The firm dates the two-user events to August 14 and 17.
[1]Notification sample dated
The letter describes file exposure and containment. The notification sample provides the account.
[1]Briefing updated
This briefing was last reviewed and updated on October 30, 2026.
Threat Group & Attack Vector
The supported path is social engineering of two users. The notice does not disclose a particular communication channel or identify the attacker. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Baker McKenzie engaged forensic specialists, informed law enforcement and contained the incident. Its specialists confirmed successful remediation, according to the firm. It offered 24 months of monitoring and reviewed additional security controls. [1]