Greenberg Traurig

Greenberg Traurig, an international law firm, experienced a data extortion incident recorded in early September 2026, with a limited set of documents exposed.

The attacker, the entry method and the client matters involved have not been established in the public reporting cited here. The firm has characterised the document exposure as limited, and that characterisation is the firm's rather than an independently verified finding.

Documents. No field-level breakdown has been published, and for this sector that phrasing is more revealing than it looks.

A law firm does not hold records in the sense a retailer does. It holds matters: contracts under negotiation, litigation strategy, regulatory filings, deal terms before announcement, and correspondence that is privileged precisely because it was never meant to be read by anyone else. The sensitivity is not in the fields, it is in whose matter the document belongs to.

Clients, almost entirely, and clients who have no visibility into the incident. A company that retained the firm for a sensitive matter now has exposure it did not create and cannot assess.

Privilege is the specific casualty. A document's protected status depends on its confidentiality, and the legal consequences of exfiltration reach into matters that may still be live. For clients in regulated sectors, their own disclosure obligations may be triggered by a breach at their counsel.

Large firms treat confidentiality as a professional obligation rather than only a compliance one, and most operate document management systems with matter-level access controls precisely because of it.

The structural difficulty is that legal work requires wide internal access. A deal team, a litigation team, support staff and conflicts checking all need to reach matter documents, and the controls have to accommodate that or the firm cannot function.

Which documents, for which clients. A firm can say how many files left. Saying which client matters they belonged to, and therefore who must be told, requires reading them.

Document management systems index by matter number, which helps, but the exposure in a breach is rarely aligned to that structure. Email attachments, working copies, shared drives and local exports sit outside the matter hierarchy, and that unstructured layer is where the content question becomes hard.

Limited is doing a lot of work in the public characterisation. Limited by count is a measurable claim. Limited by sensitivity is a claim that requires having read what left.

Reporting describes data extortion but names no group, and no leak site listing is cited in the sources used here.

Law firms are a recurring extortion target for an obvious reason: the leverage is not the firm's own willingness to pay, it is the firm's obligation to its clients. The threat is reputational and professional rather than operational.

Matter-level segmentation that survives the way lawyers actually work, including the attachments and working copies that leave the document management system.

Second, knowing which documents sit outside that system. The gap between the firm's structured matter store and the unstructured material around it is where the scoping difficulty lives, and it is answerable by inspection before an incident rather than during one.