2026 Herbert Smith Freehills Kramer — May/June system access; notices cite SSNs/IDs/health (4 individuals)
Data compromised
Vermont AG-linked reporting: Social Security numbers, government-issued ID numbers, and health records for a small number of individuals (counsel reporting cites 4). Broader client-matter inventory not published.
Technical writeup
Firm-confirmed limited breach — Reuters reported August 7, 2026 that Herbert Smith said hackers accessed a limited portion of systems in May. US counsel notices summarized via Vermont AG listings and July 29, 2026 individual notifications describe access on or around June 1, 2026 involving Social Security numbers, government IDs and health records for a very small census (reporting cites four individuals). Catalogued as confirmed with recordsAffected 4 from that notice tally; update if a larger AG filing appears. Part of the same Reuters law-firm breach roundup as Goodwin Procter.
Root cause
Hackers accessed a limited portion of systems (Reuters: May). Firm began notifying affected individuals around July 29, 2026 regarding access on or about June 1, 2026 (Vermont AG / counsel reporting).