Orrick, Herrington & Sutcliffe's data breach last year involved more people than previously reported, according to a late December update the firm filed with the offices of multiple state attorneys general.