---
title: "Troutman Pepper Locke document-disclosure incident"
description: "Troutman Pepper Locke document-disclosure incident. Firm reports no operational disruption or unauthorized system access."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-30"
canonical_url: "https://www.ally.security/incidents/troutman-pepper-locke-document-disclosure-2026"
markdown_url: "https://www.ally.security/incidents/troutman-pepper-locke-document-disclosure-2026.md"
stix_url: "https://www.ally.security/incidents/troutman-pepper-locke-document-disclosure-2026/stix.json"
---

# Troutman Pepper Locke document-disclosure incident

On August 7, 2026, a Troutman Pepper Locke employee was deceived by apparently legitimate communications and sent documents to an unauthorized recipient. The employee reported the suspicious interaction to the security team.

Last modified Oct 30, 2026 · 1 source

## Summary

- **Environment:** Documents held for legal matters
- **Operational impact:** Firm reports no operational disruption or unauthorized system access
- **Financial impact:** No confirmed incident cost quantified

## What happened

On August 7, 2026, a [Troutman Pepper Locke](https://www.troutman.com/) employee was deceived by apparently legitimate communications and sent documents to an unauthorized recipient. The employee reported the suspicious interaction to the security team. [1](#source-1)

## Impact

The documents contained personal information obtained for legal work. The public template identifies names but leaves other recipient-specific fields unspecified. Troutman said its operations were unaffected and the recipient did not gain access to its systems. [1](#source-1)

## Timeline

### August 7, 2026 — Employee deceived into document transfer

The employee reported the suspicious interaction to the security team. The [notification sample](https://oag.ca.gov/system/files/Troutman%20-%20California%20Notification.pdf) provides the account. [1](#source-1)

### October 30, 2026 — Briefing updated

This briefing was last reviewed and updated on October 30, 2026.

## Threat Group & Attack Vector

The firm describes social engineering that induced a document transfer. It does not establish compromised credentials, malware or a specific communication channel. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Troutman investigated with cybersecurity specialists, notified the FBI and offered affected recipients 24 months of credit monitoring and identity protection. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/troutman-pepper-locke-document-disclosure-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Troutman Pepper Locke LLP — notice of data incident

official · Troutman Pepper Locke LLP

<https://oag.ca.gov/system/files/Troutman%20-%20California%20Notification.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Employee deceived into document transfer: 2026-08-07
2. **Resulted In · 100% confidence · current**  
   Troutman Pepper Locke document-disclosure incident: Troutman investigated with cybersecurity specialists, notified the FBI and offered affected recipients 24 months of credit monitoring and identity protection.
3. **Resulted In · 100% confidence · current**  
   Troutman Pepper Locke document-disclosure incident: The firm describes social engineering that induced a document transfer. It does not establish compromised credentials, malware or a specific communication channel.
4. **Resulted In · 100% confidence · current**  
   Troutman Pepper Locke document-disclosure incident: Employee deceived into document transfer
5. **Affected Organization · 100% confidence · current**  
   Troutman Pepper Locke document-disclosure incident: Troutman Pepper Locke LLP
6. **Resulted In · 100% confidence · current**  
   Troutman Pepper Locke document-disclosure incident: On August 7, 2026, a Troutman Pepper Locke employee was deceived by apparently legitimate communications and sent documents to an unauthorized recipient. The employee reported the suspicious interaction to the security team.
7. **Resulted In · 100% confidence · current**  
   Troutman Pepper Locke document-disclosure incident: The documents contained personal information obtained for legal work. The public template identifies names but leaves other recipient-specific fields unspecified. Troutman said its operations were unaffected and the recipient did not gain access to its systems.

</details>