Social EngineeringProfessional ServicesProfessional ServicesCustomer Data InvolvedPIIIdentity (basic)LowContained

SHEPPARD, MULLIN, RICHTER & HAMPTON LLP

bd_58f6e1fb5ca692b9 · schema v1 · pii pii-v2

Severity

Low

Discovered

Sep 1, 2026

Filed

Oct 2, 2026

To disclose

4 weeks

Affected

Not disclosed

Linked

6 records

Confidence

69%

Full breach record for SHEPPARD, MULLIN, RICHTER & HAMPTON LLP →

Sheppard, Mullin, Richter & Hampton LLP experienced a social engineering incident on August 31, 2026, where a single attorney was tricked into disclosing documents to an unknown third party. The firm became aware on September 1, 2026. No network compromise occurred. Personal information, including basic identity data, was exposed in impacted files. The firm engaged forensic experts, notified law enforcement, and is offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 4 weeks / 31 days

Aug 31, 2026

Begins

Sep 1, 2026

Discovered

Oct 2, 2026

Filed

vs. sector median

15 wks faster

This filing is one of 6 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesilentransomgroupbd_027752b5e2afb7b72026-10-05 · +3dCandidate

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_9303f6ab9c972b7b2026-10-02Verified
Oregon State AGbd_a248f335fd6b5a262026-10-02Verified
Massachusetts State AGbd_0e710dc5bcc67a132026-10-01 · +1dCandidate
Texas State AGbd_fedf363487ea17aa2026-10-06 · +4dVerified

Name: SHEPPARD, MULLIN, RICHTER & HAMPTON LLP
norm: sheppard mullin richter hampton

Name: SHEPPARD, MULLIN, RICHTER & HAMPTON LLP
norm: sheppard mullin richter hampton
Industry: Professional Servicesllm

Discovered: Sep 1, 2026
Breach occurred: Aug 31, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 2, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1566 Phishing
Threat actor: External
Regulator citations: Notified law enforcement
Initial access: phishing_link

During the incident: Launched a comprehensive investigation
Engaged a third-party forensic firm and other third-party experts to assist in investigating what happened and what data may have been impacted
Notified law enforcement
Worked to further augment security posture
Offering complimentary 24-month membership for credit monitoring and identity theft protection services through TransUnion
Changes made: Taken additional steps to reinforce security practices
Actively reviewing systems and policies to assess what enhanced security monitoring and controls may be necessary to mitigate the risk of similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGOct 1 · first

Vermont State AG+1d

Oregon State AG+1d

California State AG+1d · this page

Texas State AG+5d

Pattern: first filing Oct 1 (MA), last Oct 6 (TX) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-630779
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 2, 2026
Raw hash: 03003970627d61eded1a23bb5894b3ce0dc2625a2296682221469d8c799ddf88

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entitySHEPPARD, MULLIN, RICHTER & HAMPTON LLP

Victim entitySHEPPARD, MULLIN, RICHTER & HAMPTON LLP

Incidentdiscovered Sep 1, 2026

Stated responseLaunched a comprehensive investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov