Baker & McKenzie LLP

In August, a cyber criminal socially engineered two Baker McKenzie users into surrendering a limited number of files, and the firm's Texas notice puts Social Security numbers and other personal information among the exposed data. The notices name no actor and no count of people affected. The firm stresses that no credentials were compromised and no system was independently accessed; the attacker never needed either. Two employees with file access were the security perimeter, and a conversation walked right to those files.