Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

GOODWIN PROCTER LLP

bd_169c974ce853c148 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 16, 2026

Filed

Jun 22, 2026

To disclose

10 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for GOODWIN PROCTER LLP →4 incidents on file

Goodwin Procter LLP experienced a cybersecurity incident on April 16, 2026, when an unauthorized actor compromised a single user account via social engineering. The actor accessed the firm's environment for a limited time and obtained personal information of one New Hampshire resident, including name, address, Social Security number, and financial account details. Goodwin disabled the account, engaged third-party experts, and notified law enforcement. The firm is offering two years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 67 days

Apr 16, 2026

Begins

Apr 16, 2026

Discovered

Jun 22, 2026

Filed

vs. sector median

9 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_4cb0a53fd8c5954c2026-06-11 · +11dCandidate
Massachusetts State AGbd_8b0c1d6ea75a01cf2026-06-11 · +11dVerified
Nebraska State AGbd_e223134300d8dc2d2026-06-11 · +11dVerified
Texas State AGbd_e606468cb7b5688a2026-07-31 · +39dVerified

Name: GOODWIN PROCTER LLP
norm: goodwin procter
Domain: goodwinlaw.com

Name: GOODWIN PROCTER LLP
norm: goodwin procter
Domain: goodwinlaw.com
Industry: Professional Servicesllm

Discovered: Apr 16, 2026
Breach occurred: Apr 16, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 11, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1566 PhishingT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney GeneralNotified law enforcement
Initial access: phishing_link

During the incident: Disabled the affected user account
Eliminated the unauthorized access
Launched an investigation with the help of third-party experts
Notified law enforcement
Offering affected individuals two years of credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 11 · first

Massachusetts State AGJun 11 · first

Nebraska State AGJun 11 · first

New Hampshire State AG+11d · this page

Texas State AG+50d

Pattern: first filing Jun 11 (IN), last Jul 31 (TX) — a 50-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/goodwin-procter-20260622.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2026
Raw hash: 4e3b1ba57746a7a15069a268ab1878508484882d59982b501b1075fd8e699f47

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGOODWIN PROCTER LLP

Victim entityGOODWIN PROCTER LLP

Incidentdiscovered Apr 16, 2026

Stated responseDisabled the affected user account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov