Thompson and Horton LLP data breach

What we know

Thompson and Horton LLP is a prominent law firm specializing in complex legal representation, often handling sensitive litigation, corporate counseling, employment matters, and institutional compliance. Because law firms routinely manage the most confidential affairs of their individual and corporate clients, they accumulate vast repositories of highly sensitive data. This includes detailed client files, proprietary business strategies, internal personnel records, financial documents, and personally identifiable information belonging to employees, partners, and opposing parties alike. The nature of legal practice requires maintaining exhaustive archives, making firms like Thompson and Horton LLP prime targets for cybercriminals seeking high-value intelligence. In 2025, Thompson and Horton LLP reported a data security incident to the Massachusetts Attorney General, signaling that unauthorized actors managed to breach their network infrastructure. While specific technical disclosures regarding the attack vector are often withheld during ongoing forensic investigations, incidents affecting law firms typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized entry into digital document management systems, or compromises of third-party vendor applications used for legal billing and secure client communications. These attacks exploit vulnerabilities in legacy IT systems or target remote access points, allowing threat actors to dwell undetected within a network and exfiltrate gigabytes of confidential files. Data breaches at law firms jeopardize a wide array of sensitive information, exposing individuals to severe and multifaceted risks. When files containing full names, Social Security numbers, dates of birth, financial account details, and private legal or employment records are compromised, the potential for harm is immediate. Social Security numbers and dates of birth provide the building blocks for comprehensive identity theft and fraudulent credit applications. Furthermore, compromised financial data and banking details expose victims to unauthorized account withdrawals and financial fraud. In the context of a law firm, the leak of confidential legal correspondence and internal HR documents can also result in corporate espionage, targeted phishing attacks, and reputational damage. As custodians of highly sensitive personal and financial data, Thompson and Horton LLP had strict legal and ethical obligations under Massachusetts state data protection laws and common law principles of confidentiality. These standards require businesses and professional service providers to implement robust administrative, physical, and technical safeguards—such as multi-factor authentication, end-to-end encryption, regular vulnerability assessments, and strict access controls—to protect stored data from unauthorized disclosure. The occurrence of a successful data breach strongly suggests that these mandated security protocols were either inadequate or negligently maintained, representing a potential failure of the firm's duty of care to safeguard confidential information. Receiving a formal data breach notification letter from Thompson and Horton LLP is a critical legal development that serves as an official admission that your personal data was compromised due to their security failure. Under modern class action jurisprudence, the receipt of such a notification letter establishes legal standing to participate in litigation, allowing affected individuals to seek accountability and compensation without needing to wait until actual financial fraud occurs. Our law firm is currently investigating potential class action claims against Thompson and Horton LLP on a contingency fee basis. This means there is no financial risk or upfront cost to you; we only recover legal fees if we successfully secure a recovery on behalf of the affected class.

See every breach reported in Massachusetts or read what to do after a ransomware attack.