HackingProfessional ServicesFinancial accountGovernment IDPCIMediumContained

GOODWIN PROCTER LLP

bd_8b0c1d6ea75a01cf · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 11, 2026

To disclose

—

Affected

5state residents only

Linked

5 filings

Confidence

67%

Full breach record for GOODWIN PROCTER LLP →4 incidents on file

Goodwin Procter LLP, a law firm, notified Massachusetts residents of a cybersecurity incident affecting client personal information, including names, Social Security numbers, credit/debit card numbers, and loan account numbers. The firm disabled the affected user account, engaged third-party experts, and notified law enforcement. No evidence of continued unauthorized access was found. The firm is offering two years of complimentary credit and identity monitoring through Equifax.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jun 11, 2026

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_4cb0a53fd8c5954c2026-06-11Candidate
Nebraska State AGbd_e223134300d8dc2d2026-06-11Verified
New Hampshire State AGbd_169c974ce853c1482026-06-22 · +11dVerified
Texas State AGbd_e606468cb7b5688a2026-07-31 · +50dVerified

Name: GOODWIN PROCTER LLP
norm: goodwin procter
Domain: goodwinlaw.com

Name: GOODWIN PROCTER LLP
norm: goodwin procter
Domain: goodwinlaw.com

Discovered: —
Materiality determined: —
Notification sent: Jun 8, 2026
Affected individuals: 5state-resident count only
Data types: Financial accountGovernment IDPCI
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Took action to disable the affected user account
Eliminate the unauthorized access
Launch an investigation with the assistance of third-party experts
Notified, and are working with, law enforcement
Changes made: Offering you two years of credit and identity monitoring services through Equifax at no cost to you
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 11 · first

Nebraska State AGJun 11 · first

Massachusetts State AGJun 11 · first · this page

New Hampshire State AG+11d

Texas State AG+50d

Pattern: first filing Jun 11 (IN), last Jul 31 (TX) — a 50-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-960-goodwin-procter-llp/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2026
Raw hash: e35f3fe7b6c67c80e5c33923dc16a458fa2d4c27ed5ecf62c323ab671c60b535

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGOODWIN PROCTER LLP

Victim entityGOODWIN PROCTER LLP

IncidentUnauthorized Access

Stated responseTook action to disable the affected user account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov