The law firms in the graphic below submitted data breach notifications to state authorities, reporting when the personal information of employees, clients or other personnel linked to them may have been exposed.

Also in This Series: How Vendor Data Breaches Are Putting Law Firms at Risk

The reports include law firms that may have experienced breaches directly or through third parties, including vendors. (Scroll past the graphic for more on the disclosures and our methodology.)

For a reporting investigation into legal industry data leaks, Law.com submitted open records requests to 14 states for law firm breach notifications from 2013 through 2018. For other states, we inspected state government websites that list security notices, including some breaches in 2019 and breaches before 2013.

Other states had no records at all. About 20 states and the District of Columbia do not require most businesses, including law firms, to report data breaches to state authorities.

In other states, reporting to state authorities is limited and only triggered when a data breach crosses a certain threshold. For instance, in California, an entity that notifies more than 500 California residents of an incident must complete a security breach form from the state's attorney general office.

In some cases, a law firm submitted duplicate reports about the same breach to multiple states. In other cases, a firm may have submitted an updated report about a breach earlier reported.

While Law.com obtained reports from more than 100 firms—which are searchable above—cybersecurity experts warn they are just the tip of the iceberg in law firm data leaks.

"Law firms are only going to make those reports when they've confirmed through a forensic investigation that reportable information has been touched," said Austin Berglas, former head of the FBI's cyber breach unit in New York and now global head of professional services at cybersecurity company BlueVoyant. "They're not going to report every event, every spearfishing campaign—they see it every day."

Read More

More Than 100 Law Firms Have Reported Data Breaches. And the Problem Is Getting Worse