Foley and Lardner LLP data breach

What we know

Foley and Lardner LLP is a prominent, nationally recognized Am Law 50 full-service law firm providing sophisticated legal counsel to clients across the healthcare, life sciences, energy, technology, and manufacturing sectors. Because of the elite and sensitive nature of their practice, the firm routinely handles, stores, and transmits an immense volume of highly confidential data. This repository includes not only proprietary corporate secrets, intellectual property, and merger and acquisition due diligence files, but also personally identifiable information (PII) and financial records belonging to corporate executives, employees, opposing parties, and private individuals involved in complex litigation or transactional matters. In 2025, Foley and Lardner LLP formally reported a significant security incident to the Nebraska Attorney General, alerting regulators and affected individuals that its digital network had been compromised. While law firm data breaches frequently stem from sophisticated cyberattacks—such as unauthorized access to document management systems, third-party vendor vulnerabilities, or targeted malware deployment—the exposure highlights critical chokepoints in the digital infrastructure of organizations entrusted with elite-level confidences. When threat actors infiltrate a legal enterprise, they target the vast archives of unencrypted documents, client files, and administrative databases where sensitive personal information is often consolidated. The breach compromised a sweeping array of sensitive data fields, each carrying severe and long-term risks for the individuals affected. Exposed information likely included full names, Social Security numbers, dates of birth, financial account details, tax documents, and confidential correspondence detailing sensitive personal and business matters. When data of this nature is exposed, victims face an elevated, persistent threat of identity theft, financial account takeover, targeted phishing schemes, and fraudulent tax filings. For corporate clients and high-profile individuals, the compromise of confidential legal files also introduces severe risks of corporate espionage, reputational damage, and unauthorized disclosure of proprietary strategies. As a professional services organization operating in multiple jurisdictions, Foley and Lardner LLP was bound by stringent legal and ethical obligations to safeguard the sensitive data entrusted to its care. These obligations derive from state data protection statutes, the Nebraska Consumer Protection Act, common law duties of confidentiality, and industry-standard frameworks established by organizations like the American Bar Association. The occurrence of a data breach of this scale strongly indicates potential failures in reasonable cybersecurity measures—such as inadequate network segmentation, delayed patch management, insufficient employee training, or improper access controls—that directly enabled unauthorized third parties to infiltrate the firm's systems. Receiving a data breach notification letter from Foley and Lardner LLP is a formal acknowledgment by the firm that your personal or professional information was compromised as a result of their inadequate security practices. Under consumer protection and privacy laws, affected individuals have the legal standing to pursue class action litigation to hold the firm accountable for failing to protect their data. Crucially, victims do not need to prove that they have already suffered actual financial loss or identity theft to participate in a lawsuit; the increased risk of future harm and the cost of mitigation are sufficient legal injuries. Our firm is currently investigating potential class action claims on behalf of all individuals who received a notification letter from Foley and Lardner LLP, operating on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.

See every breach reported in Nebraska or read what to do after a ransomware attack.