Adds comment from plaintiff in paragraph 9

By Mike Scarcella

WASHINGTON, July 15 (Reuters) - Large U.S. law firm WilmerHale has been sued in federal court in Washington over a data breach that allegedly exposed sensitive personal data in a cyberattack earlier this year.

The lawsuit, filed on Tuesday, alleges the prominent firm failed to protect personally identifiable information on its network, including names and Social Security numbers.

The plaintiff, Nevada resident Jason Perry, said he was suing on behalf of himself “and thousands of other similarly situated persons in the massive and preventable cyberattack.”

In a statement, WilmerHale said "an unauthorized third party that has been targeting firms across the legal industry recently obtained a limited set of information from the firm."

It said a review showed the incident was isolated, that no internal data was misused or disseminated, and that "the third party did not directly access the firm’s systems or network."

"We regret this incident occurred and are continuing to enhance our security posture in response to the evolving threat landscape," the firm said.

Perry said he received a notice from the law firm that his private information was involved in the breach. The lawsuit did not describe Perry’s relationship with WilmerHale, which employs more than 1,100 lawyers in offices in the United States and Europe.

The lawsuit said Perry and others “were required to provide their private information to defendant in order to receive services.”

A lawyer for Perry, Laura Van Note, in a statement said "while every large data breach is serious, for a global law firm like Wilmer Hale to have poor data security is particularly shocking." Van Note said the size of the intrusion has not been made public but that the "breach was reported by the firm in multiple states."

Law firms have increasingly become targets in cyberattacks. Other recent data-related lawsuits were filed against law firms including Wiley Rein, Fox Rothschild and Blank Rome.

The complaint alleges WilmerHale's network was breached in May. It did not identify the hackers or specify how the alleged intrusion occurred, stating only that one or more unauthorized third parties accessed class members' private data.

A notice on the Vermont attorney general’s office data breach notice website shows a July 10 listing from WilmerHale. The notice said a breach affected 11 Vermont residents.

Perry’s lawsuit seeks unspecified monetary damages and improved data-security measures.

The case is Jason Perry v. Wilmer Cutler Pickering Hale and Dorr, U.S. District Court, District of Columbia, No. 1:26-cv-02470.

For plaintiff: Laura Grace Van Note of Cole & Van Note, and David Wise of Wise Law Firm

For defendant: No appearance yet

Read more:

US law firm Blank Rome faces class action over data breach

Law firm Fox Rothschild hit with class action over data breach

Law firm Wiley Rein hit with class action over data breach tied to Chinese hackers

Law firm Pillsbury faces class actions over April data breach