---
title: "Baker McKenzie social-engineering file disclosure"
description: "Baker McKenzie social-engineering file disclosure. Firm reports containment and no independent malicious system access."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-30"
canonical_url: "https://www.ally.security/incidents/baker-mckenzie-social-engineering-file-disclosure-2026"
markdown_url: "https://www.ally.security/incidents/baker-mckenzie-social-engineering-file-disclosure-2026.md"
stix_url: "https://www.ally.security/incidents/baker-mckenzie-social-engineering-file-disclosure-2026/stix.json"
---

# Baker McKenzie social-engineering file disclosure

Baker McKenzie says an attacker socially engineered two users on August 14 and 17, 2026 and obtained a limited number of files connected with legal services.

Last modified Oct 30, 2026 · 1 source

## Summary

- **Environment:** Files held for client legal services
- **Operational impact:** Firm reports containment and no independent malicious system access
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Baker McKenzie](https://www.bakermckenzie.com/) says an attacker socially engineered two users on August 14 and 17, 2026 and obtained a limited number of files connected with legal services. [1](#source-1)

## Impact

The firm identified personal information in affected files, but the public template redacts the specific fields. It reports no evidence that credentials or additional user accounts were compromised and says there was no independent malicious access to its systems. [1](#source-1)

## Timeline

### August 14, 2026 — First reported social-engineering event

The firm dates the two-user events to August 14 and 17. [1](#source-1)

### October 27, 2026 — Notification sample dated

The letter describes file exposure and containment. The [notification sample](https://oag.ca.gov/system/files/Baker%20McKenzie%20-%20Template_0.pdf) provides the account. [1](#source-1)

### October 30, 2026 — Briefing updated

This briefing was last reviewed and updated on October 30, 2026.

## Threat Group & Attack Vector

The supported path is social engineering of two users. The notice does not disclose a particular communication channel or identify the attacker. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Baker McKenzie engaged forensic specialists, informed law enforcement and contained the incident. Its specialists confirmed successful remediation, according to the firm. It offered 24 months of monitoring and reviewed additional security controls. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/baker-mckenzie-social-engineering-file-disclosure-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Baker & McKenzie LLP — notice of data incident

official · Baker & McKenzie LLP

<https://oag.ca.gov/system/files/Baker%20McKenzie%20-%20Template_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Baker McKenzie social-engineering file disclosure: Baker McKenzie engaged forensic specialists, informed law enforcement and contained the incident. Its specialists confirmed successful remediation, according to the firm. It offered 24 months of monitoring and reviewed additional security controls.
2. **Resulted In · 100% confidence · current**  
   Baker McKenzie social-engineering file disclosure: The firm identified personal information in affected files, but the public template redacts the specific fields. It reports no evidence that credentials or additional user accounts were compromised and says there was no independent malicious access to its systems.
3. **Resulted In · 100% confidence · current**  
   Baker McKenzie social-engineering file disclosure: Notification sample dated
4. **Affected Organization · 100% confidence · current**  
   Baker McKenzie social-engineering file disclosure: Baker & McKenzie LLP
5. **Resulted In · 100% confidence · current**  
   Baker McKenzie social-engineering file disclosure: First reported social-engineering event
6. **Occurred At · 100% confidence · current**  
   Notification sample dated: 2026-10-27
7. **Resulted In · 100% confidence · current**  
   Baker McKenzie social-engineering file disclosure: The supported path is social engineering of two users. The notice does not disclose a particular communication channel or identify the attacker.
8. **Occurred At · 100% confidence · current**  
   First reported social-engineering event: 2026-08-14
9. **Resulted In · 100% confidence · current**  
   Baker McKenzie social-engineering file disclosure: Baker McKenzie says an attacker socially engineered two users on August 14 and 17, 2026 and obtained a limited number of files connected with legal services.

</details>