K&L Gates LLP, the international law firm headquartered in Pittsburgh, has posted a Notice of Data Event describing a cyberattack on one workstation. This page summarizes what the firm has disclosed so far about the incident and the people affected.
K&L Gates’s Data Breach Investigation
K&L Gates has told the public that it recently finished investigating suspicious activity tied to a single employee’s account. According to the firm’s notice, an unauthorized actor gained remote access to one workstation and used that access to acquire certain files on April 27, 2026. The firm describes the intrusion as involving that single workstation.
The notice says the firm is notifying individuals on behalf of certain of its clients. A law firm holds personal information on behalf of the organizations it serves, so a person who receives a letter may learn about this incident through a notice that references the firm rather than a company, hospital, insurer or other organization they dealt with directly. If you received a letter from or on behalf of K&L Gates, your information was likely in the files at issue.
After the files were identified, the firm carried out a detailed review of the data to work out what each file contained and to whom it belonged. That review is a common source of delay in breach notices, because large document sets have to be read, categorized and matched to individuals before anyone can be told. According to the notice, the review was completed on September 22, 2026, and notification of potentially affected people followed.
The firm states that it is not aware of any identity theft or fraud connected to the event. That statement reflects what the firm knows today and is not a guarantee about the future. Stolen files can be held for a long time before they are used, sold or published, and the absence of a reported misuse does not mean the information is safe. The notice does not describe whether the files were published or offered for sale, and it does not identify who was behind the intrusion.
K&L Gates says it responded by starting an investigation as soon as it saw the suspicious activity and by putting additional security measures in place related to data privacy and security. The notice does not describe those measures in detail, does not say which outside specialists, if any, assisted, and does not mention an offer of credit monitoring or identity protection services. It does set up a dedicated toll-free assistance line for questions, staffed on weekdays, and gives a Pittsburgh mailing address for written inquiries.
No total number of affected people has been published. The notice does not give a count, and the public posting does not break the figure down by state. It does include state-specific information for residents of the District of Columbia, Maryland, New Mexico, New York, North Carolina and Rhode Island, and it says that Rhode Island residents may be impacted. A list of states in a notice is not the same as a list of where affected people live, and the number of people affected in each place has not been made public.
Law firms are frequent targets for cyberattacks because they keep concentrated stores of sensitive material in one place, including identity records, financial documents and medical information gathered for transactions, disputes and claims. A single compromised workstation can be enough to reach files that were copied from many different matters. When the files hold the combination of data types listed in this notice, the exposure can create risk for many people at once, even when the technical breach itself is described as narrow.
Because the notice is the only detailed public source so far, the most reliable way to learn whether your own information was involved is the letter you receive. Keep it, record the date it arrived and note the name of the organization on whose behalf it was sent. Details about the scope and consequences of the incident may become clearer as more information is disclosed, and this page reflects only what the firm has confirmed in its own posted notice.
When Did This Breach Occur?
According to the firm’s notice, the unauthorized actor acquired files from the workstation on April 27, 2026. K&L Gates completed its review of the affected data on September 22, 2026, and then began notifying potentially affected individuals on behalf of certain clients. The notice does not give the date the suspicious activity was first noticed or a precise date on which letters were mailed, so the timing of discovery should be treated as not publicly stated.
What Information Was Breached?
The firm says its investigation and review found that the event involved names, dates of birth, Social Security numbers, driver’s license numbers, financial information and medical information. Not every person is affected in the same way, and the specific items involved vary by individual. Your notice letter is the best guide to what applies to you. The combination of identity numbers with financial and medical details can be used for identity theft, fraudulent accounts and medical fraud, so those who were notified should take it seriously.
What You Can Do
If you received a notice related to K&L Gates or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, noting which organization the letter was sent on behalf of.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card, insurance and medical statements and explanation-of-benefits forms for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against K&L Gates
If you received a notice about this incident, or you believe your Social Security number, financial information or medical information was exposed, you may have legal options for holding the responsible parties accountable for how they protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
