Quinn Emanuel and McDermott Data Breaches: What Was Exposed and What Remains Unknown

Law firms Quinn Emanuel and McDermott disclosed separate recent cybersecurity incidents involving sensitive files and personal data. The public record describes constrained access rather than a publicly identified ransomware campaign, but the information involved—including litigation material, Social Security numbers and health records—makes the events consequential. Both firms said they notified law enforcement. 3

What Quinn Emanuel disclosed

Quinn Emanuel said an unauthorized third party gained access on August 14 through social engineering. In an August 25 letter to counsel for activist short seller Muddy Waters, the firm said some files relating to Muddy Waters had been accessed. Those materials had been obtained by Quinn Emanuel in separate Florida litigation. 3

The firm said the incident involved unauthorized access to stored files in one software application through one temporarily compromised user account. It characterized the affected client documents as limited and said affected parties had been informed. Public reporting did not establish a total number of files or people affected. 3

What McDermott disclosed

McDermott reported unauthorized access to stored files through one software application and one temporarily compromised user account. A regulatory disclosure identified 15 affected individuals. The exposed information included Social Security numbers and health-information records. 3

McDermott made state breach notifications in addition to reporting the matter to law enforcement. In a separate published security-incident notice, the firm said it engaged third-party specialists to investigate and analyze affected files, and that it strengthened administrative and technical safeguards and provided additional cybersecurity training. 3

What is not known

The disclosures did not publicly identify the person or group responsible. They also did not establish that the two breaches were connected, that a ransomware or extortion group was involved, or that the accessed data was exfiltrated beyond the files described in the notices. A shared conclusion should therefore be limited: both incidents illustrate the risk posed by compromise of a user account, not evidence of a common operator. 3

Why the Muddy Waters files added another layer of sensitivity

Quinn Emanuel’s incident drew particular attention because the accessed material related to Muddy Waters, a former client of the firm. Quinn Emanuel later represented power-tool maker Techtronic Industries in litigation against Muddy Waters, and Muddy Waters sought the firm’s disqualification, arguing that the earlier relationship created a conflict of interest. 6

A federal judge in Austin subsequently removed Quinn Emanuel from the Techtronic case, ruling that its prior representation of Muddy Waters created a conflict. Quinn Emanuel said it planned to appeal and denied a conflict. The ruling addresses legal-ethics and client-loyalty issues; it does not establish that Quinn Emanuel caused the cyber incident or that an intruder acted for Techtronic or another litigation participant. 5

Part of a wider legal-sector problem—but not a proven single campaign

The Quinn Emanuel and McDermott reports followed other law-firm cybersecurity disclosures in 2026. Herbert Smith Freehills Kramer said unauthorized users accessed a limited portion of its systems after an incident it became aware of in late May. Goodwin Procter and Taft Stettinius & Hollister also made state-regulator breach disclosures around the same period.

WilmerHale faced a proposed federal class action following a cyberattack that allegedly exposed sensitive personal data, including names and Social Security numbers. The firm said an unauthorized third party targeting firms across the legal industry obtained a limited set of information.

Taken together, the disclosures show why legal organizations remain high-value targets: a single account or application can provide access to privileged documents and identity data. But the reports do not justify treating every law-firm incident as part of one confirmed campaign. Attribution, scope and data handling must be assessed case by case. 3