Orrick law firm breach exposed data on more than 637,000 people

Orrick, Herrington & Sutcliffe, a San Francisco-based international law firm, completed notifications in January 2024 to more than 637,000 people whose personal information was taken in a March 2023 intrusion.

The firm said an unauthorized party was inside its network for roughly two weeks, from February 28 to March 13, 2023, when the activity was discovered. Much of the compromised data did not belong to Orrick's own staff or its direct clients. It belonged to individuals covered by organizations the firm had represented in earlier breach matters, including EyeMed Vision Care, Delta Dental of California, MultiPlan, Beacon Health Options, now known as Carelon, and the U.S. Small Business Administration.

The exposed records included names, dates of birth, postal and email addresses, Social Security numbers, passport, driver's license and tax identification numbers, medical treatment and diagnosis details, insurance claims information and, for some people, payment card numbers.

The victim count grew in stages as the firm worked through the affected data. Orrick first reported 40,823 individuals in June 2023, revised that to 152,818 in July, 461,100 in August and 637,620 in December 2023. It offered two years of identity monitoring through Kroll. A spokesperson said the firm regretted "the inconvenience and distraction that this malicious incident caused." Orrick had reached a settlement in principle in December 2023 covering consolidated class actions over the delayed notification, and later agreed to pay $8 million.