Womble Bond Dickinson (US) LLP, a law firm, has sent notices of a data breach to people whose personal information it held in connection with legal services. According to the notice, the incident began when a member of the firm’s personnel handed information to someone who was not who they claimed to be. Organizations that hold sensitive client information have a responsibility to protect it, and to tell people promptly when that duty is not met.
Womble Bond Dickinson’s Data Breach Investigation
Womble Bond Dickinson (US) LLP has notified individuals of a security event that affected certain personal information the firm held. In its notice letter, the firm explains that it is a law firm and that it received the information in connection with providing legal advice. The notice was filed with the Massachusetts Attorney General’s office and the Massachusetts Office of Consumer Affairs and Business Regulation, whose 2026 breach report lists the filing as number 2026-1757 and records one affected Massachusetts resident.
According to the notice, the incident began on August 20, 2026, when one of the firm’s personnel mistakenly provided information to an unauthorized third party who misrepresented their identity. The firm states that once it learned of the incident it activated its incident response procedures, notified law enforcement, and engaged outside experts to assist with a forensic investigation. Based on that investigation, the firm describes the event as isolated and says the unauthorized third party did not directly access its systems or network. The firm also says it is not aware of any further disclosure or misuse of the information.
This type of event is different from a conventional hacking incident, and that difference matters. Instead of breaking into a network, the person behind the request pretends to be someone with a legitimate reason to receive the information. Security professionals often call this social engineering or impersonation fraud. It can succeed even at organizations with strong technical defenses because it targets a human decision rather than a piece of software. Law firms are frequent targets because they hold large amounts of sensitive client data, including financial records, identity documents and details of private legal matters.
The notice letter available to the public is a template with the recipient-specific fields left blank, so it does not list the exact categories of information involved for each person. The Massachusetts breach report, however, flags that Social Security numbers were involved in the filing and does not flag medical records, financial account numbers, driver’s license numbers or payment card numbers. The firm has not publicly stated how many people in total were affected, and the only count available in the filing is the single Massachusetts resident. Notices filed in one state frequently represent only a small share of the people notified nationwide, so the total number of affected individuals may be higher.
Notably, the firm describes the cause as a mistake by an individual rather than a failure of its network security. For people whose information was involved, though, the cause makes little practical difference. What matters is what the unauthorized party now has, who they are, and whether they intend to use it. The public notice does not answer those questions, which is one reason careful monitoring is worthwhile.
The firm says it has no indication that any of the information has been misused, and it states that it does not believe the information will be distributed or used improperly. Those statements come from the firm itself and are not independently verified. Even so, a Social Security number in the wrong hands can be used for years, because unlike a password it cannot easily be changed. A person who has the number, along with a name and address, may be able to attempt to open credit accounts, file false tax returns or claim benefits in someone else’s name.
To help people respond, the firm arranged for Kroll to provide identity monitoring and related services at no cost for 24 months. The services described in the letter include credit monitoring, a current credit report, dark web monitoring, a Social Security number scan, payday loan monitoring, identity fraud loss reimbursement, fraud consultation and identity theft restoration. People who receive the letter enroll using the membership number printed on it. Anyone who received a notice from Womble Bond Dickinson should read it closely, keep a copy, and take advantage of the offered protections while they are available.
When Did This Breach Occur?
The notice states that the incident began on August 20, 2026, when information was provided to an unauthorized third party who had misrepresented their identity. The firm says it acted promptly after learning of the incident, though the letter does not say on what date the firm discovered the problem or how long the unauthorized party had the information.
The Massachusetts filing was reported on October 9, 2026. Because the public copy of the letter leaves the mailing date as a blank template field, the exact date individual notices were sent has not been confirmed. People who received a letter should treat the date printed on their own copy as the controlling date.
What Information Was Breached?
The information involved was provided to the unauthorized third party by a member of the firm’s personnel. The public notice template leaves the specific data elements blank for each recipient, so it does not give a universal list. The Massachusetts breach report indicates that Social Security numbers were involved in this filing.
Because the firm is a law firm that received personal information while providing legal advice, the information may also relate to the legal matters in which clients were involved. The firm has not publicly described any other categories. Each notice recipient should check their own letter to see exactly what applies to them, and should assume other identifying details such as a name and mailing address could be connected to the exposed number.
What You Can Do
If you received a notice from Womble Bond Dickinson, consider these steps:
- Enroll in the Kroll identity monitoring services offered in your letter, using the membership number printed on it.
- Review your credit reports from Equifax, Experian and TransUnion, which you can request for free each year at annualcreditreport.com.
- Consider placing a fraud alert or a free credit freeze with the credit bureaus, especially if a Social Security number was involved.
- Watch your financial accounts, insurance statements and tax records for activity you do not recognize.
- Be cautious of calls, emails or texts that reference your legal matters or ask for more personal details, since the people who obtained the information may try again.
File a Data Breach Lawsuit Against Womble Bond Dickinson
Data breaches involving law firms and Social Security numbers can lead to real financial and privacy harm. If you were notified that your information was involved in the Womble Bond Dickinson incident, you may have legal options, including joining a class action to seek compensation.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
