Get started

Security and privacy

Fake IT help desk calls are behind this fall's law firm breaches: a playbook for small firms

Seyfarth Shaw, Sheppard Mullin, and Greenberg Traurig all disclosed breaches this fall, and the FBI has warned that a group posing as IT staff has targeted U.S. law firms since 2023. What happened, how the scam works, and eight steps a small firm can take this week.

Published 5 min read

By Robert Pasha

Several large law firms disclosed data breaches in September and October 2026, and the pattern is the same in many of them. Nobody broke through a firewall. Someone called or messaged a person at the firm, pretended to be someone they trusted, and got documents handed over.

Solo and small firms are not too small for this. The FBI has warned that one group running exactly this play "has consistently targeted US-based law firms since Spring 2023." And a small firm usually has fewer people to notice something is off.

What happened this fall

  • Seyfarth Shaw. Someone impersonating a member of the firm's IT help desk deceived an employee into emailing a limited number of client documents to an outside account. Names and Social Security numbers were exposed. The firm said the incident was isolated to one employee and that its controls kept the attacker out of its network. It reported the breach to officials in Texas and California, Above the Law reported on September 24.
  • Sheppard Mullin. An attorney fell victim to a social engineering attack and gave documents to an unknown third party. The firm disclosed the incident to the California attorney general on October 2. On October 7, a former paralegal filed a proposed class action in the Central District of California. She alleges at least 1,000 people were affected, that names, Social Security numbers, and driver's license and ID numbers were exposed, and that the firm failed to train employees and to give notice within the time California law requires, the ABA Journal reported on October 9.
  • Greenberg Traurig. The firm said an unauthorized actor accessed a "limited" number of documents, which were posted on the dark web. A later regulatory notice showed Social Security information was exposed. The firm now faces two proposed class actions, Above the Law reported on September 22, citing Reuters.

These are not isolated. The ABA Journal noted that WilmerHale was sued in July 2026 over an accidental client data disclosure, and Fox Rothschild was sued in June 2026 over a breach tied to a ransom group.

How the fake IT call works

On May 26, 2026, the FBI issued FLASH-20260526-01 about the Silent Ransom Group, also known as Luna Moth, Chatty Spider, and UNC3753. According to the alert:

  • The attackers pose as your IT department. They call employees directly, or send phishing emails urging them to call.
  • On the call, they direct the employee to grant access to a remote desktop session.
  • If that fails, they may send a person to the office to plug a storage device into a computer, claiming they need to "image the device or create a backup file."
  • They copy data out using legitimate file-transfer tools, then demand payment and threaten to post or sell it. They may also call employees or clients to add pressure.

The Florida Bar News summarized the FBI's advice for firms. Watch for unauthorized downloads of remote tools such as Zoho Assist, Syncro, AnyDesk, Splashtop, and Atera. Verify the credentials of anyone seeking access to your office or systems. Train staff to recognize phishing. Keep regular backups. Require multifactor authentication. And set clear procedures for how real IT staff identify themselves before asking for access.

Why this hits small firms hard

A large firm has a help desk, a security team, and an incident response budget. In a small firm, the "IT department" may be an outside contractor, a relative, or you. That makes the impersonation easier, not harder. Your assistant may never have spoken to your IT person and has no way to know what their voice sounds like.

The lawsuits also show where the second wave of risk comes from. Once client data is out, the questions turn to training, safeguards, and how fast you gave notice. Those are things you can prepare for now.

What to do this week

  1. Set a call-back rule. No one gets remote access, a password, or a document because of an inbound call or email claiming to be IT, a bank, or a court. Hang up and call back on a number you already have on file.
  2. Agree on how your real IT provider identifies itself. Write it down and tell everyone in the office. A shared code phrase or a ticket number they must give works for a small team.
  3. Lock down remote access tools. Know which remote support tool your provider uses. Ask them to block or alert on installs of any others, including the ones the FBI lists.
  4. Turn on multifactor authentication for email, document storage, practice software, and banking. Start with email.
  5. Do not let strangers touch your computers. Anyone who shows up to "back up" a device needs to be expected, verified, and supervised.
  6. Keep less sensitive data. Do not store Social Security numbers, card numbers, or bank account numbers where you do not need them. Data you do not hold cannot leak. LawMOR, for example, strips card, Social Security, and bank numbers from call transcripts and texts.
  7. Write a one-page breach plan. List who you call first (your IT provider, your cyber insurer, outside counsel), where your backups are, and which state notification laws apply to your clients.
  8. Run a five-minute drill. At your next staff meeting, role-play the fake IT call. It is easier to say "I'll call you back" under pressure if you have practiced it once.

This post is general information, not legal advice; check your state's rules on data security and breach notification.

Sources