Dykema Gossett PLLC data breach

What we know

Dykema Gossett PLLC operates as a prominent, multi-office corporate law firm handling complex litigation, intellectual property, regulatory compliance, labor and employment, and high-stakes corporate transactions. Because law firms routinely act as repositories for an extraordinary volume of confidential information, Dykema Gossett PLLC holds deep reservoirs of sensitive data. This includes proprietary corporate trade secrets, extensive litigation discovery materials, internal human resources records, confidential client communications, and personally identifiable information belonging to partners, employees, opposing parties, and corporate clients. The firm maintains this data across diverse digital ecosystems, local servers, and cloud-based document management platforms to facilitate daily legal operations across multiple jurisdictions.

In 2026, Dykema Gossett PLLC formally reported a significant data security incident to the Indiana Attorney General, triggering legal notification requirements under state law. While the precise vector of the intrusion continues to be evaluated, security incidents affecting major legal institutions typically involve unauthorized third-party access to corporate networks, sophisticated ransomware deployment, or compromise within a third-party vendor's digital supply chain. Because law firms handle dense webs of interconnected corporate and individual data, cybercriminals frequently target these networks to exfiltrate high-value documentation before security teams can isolate compromised segments or neutralize persistent threats.

The data compromised during the security incident likely encompasses a severe combination of personally identifiable information and confidential corporate records, including full names, dates of birth, Social Security numbers, banking details, tax documents, and sensitive legal or personnel files. The exposure of this information creates severe, immediate risks for affected individuals. When Social Security numbers and dates of birth are exfiltrated alongside financial or employment records, victims face a heightened, long-term threat of identity theft, fraudulent credit card applications, unauthorized tax return filings, and targeted phishing scams designed to harvest additional credentials. For corporate and individual clients whose private legal strategies or proprietary data were stored within the firm's repository, the breach also introduces significant risks of corporate espionage and unauthorized disclosure of confidential matters.

As a professional services entity entrusted with sensitive client and employee data, Dykema Gossett PLLC was bound by rigorous legal obligations under state data protection statutes, the Indiana Disclosure of Security Breach Law, and implied duties of confidentiality inherent in the attorney-client relationship. These legal frameworks mandate the implementation of robust administrative, physical, and technical safeguards—such as multi-factor authentication, robust network segmentation, regular vulnerability assessments, and strict access controls—to protect stored personal information from unauthorized access. The occurrence of a successful network intrusion and subsequent data exfiltration strongly suggests potential security failures or lapses in maintaining adequate defensive infrastructure, meaning the firm may have fallen short of its legal duties to safeguard sensitive records.

Receiving a formal data breach notification letter from Dykema Gossett PLLC serves as legal confirmation that your personal or professional information was compromised as a direct result of the firm's security failures. Under the law, the receipt of this notice establishes the necessary legal standing to participate in a class action lawsuit seeking accountability, institutional security reforms, and financial compensation for the risks and burdens imposed upon you. Importantly, affected individuals do not need to demonstrate actual financial loss to join a class action; the mere exposure of your private data constitutes a compensable injury. Our firm evaluates and investigates these data breach cases on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.

See every breach reported in Indiana or read what to do after a ransomware attack.