The Seltzer Firm (on behalf of attached list of clients) data breach

What we know

The Seltzer Firm operates as a specialized legal practice handling complex litigation, corporate counseling, and sensitive client advisory services across multiple jurisdictions. Because of the nature of legal representation, law firms like The Seltzer Firm routinely collect, process, and retain an extraordinary volume of confidential personal and financial data. This information typically includes not only internal employee and administrative records, but also highly sensitive client documentation, litigation files, corporate governance records, tax filings, proprietary business intelligence, and banking details necessary for trust accounting and settlements. The firm acts as a trusted repository for data that, if compromised, exposes individuals and corporate entities to severe privacy and security risks. In 2025, The Seltzer Firm reported a significant security incident to the Massachusetts Attorney General, raising serious concerns regarding the safety of the sensitive information entrusted to its care. While the precise mechanics of the breach are still under investigation, incidents involving legal institutions frequently stem from unauthorized network intrusions, compromised employee credentials, or vulnerabilities within third-party vendor platforms used for document management and cloud storage. In the legal sector, threat actors actively target firms specifically because a single breach can yield a massive trove of aggregated personal identifiable information and high-value corporate secrets, creating a lucrative opportunity for cybercriminals. Based on the typical profile of data maintained by a law firm, the information exposed in this incident likely includes full legal names, Social Security numbers, dates of birth, driver's license numbers, confidential financial account details, tax documents, and privileged correspondence. The exposure of this specific data creates severe, long-term risks for affected individuals. Social Security numbers and dates of birth form the core components required for identity theft and fraudulent credit applications. Furthermore, leaked financial and tax details expose victims to unauthorized bank account access, tax refund fraud, and sophisticated phishing schemes designed to extract further personal or corporate assets. Under Massachusetts state privacy laws, as well as common law duties of care and professional responsibility obligations, legal entities that collect and store sensitive personal information are legally required to implement and maintain robust, reasonable cybersecurity measures. These obligations mandate the encryption of sensitive data both in transit and at rest, regular security audits, multi-factor authentication, and employee training to prevent unauthorized access. The occurrence of a data breach of this scale strongly indicates potential failures in these security protocols, suggesting that the firm may have fallen short of its legal duty to adequately protect the confidential data entrusted to it. Receiving a data breach notification letter from The Seltzer Firm is a formal acknowledgment that your private information was compromised as a result of inadequate security practices. Legally, the receipt of this letter establishes the concrete injury and standing necessary to participate in a class action lawsuit against the firm. Importantly, victims of data breaches are not required to demonstrate immediate financial loss to seek legal recourse; the increased risk of future identity theft and the loss of privacy alone are recognized grounds for compensation. Our firm evaluates these cases on a strict contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.