WilmerHale’s Data Breach Lawsuits Were Consolidated on August 19 Into a Single “In Re” Case. Six Weeks After the Letters Went Out, the Only Count Anyone Has Sworn To Is “Thousands to Tens of Thousands”

Searches for “wilmerhale data breach,” “letter from wilmerhale” and “wilmerhale data breach letter” rose roughly fourfold on our pages this week. That pattern — a spike in letter queries — is what a notification mailing looks like from the outside, and the letters in this case are dated July 15, 2026.

Meanwhile, the litigation quietly changed shape. The docket in the District of Columbia shows:

• July 14, 2026 — Jason Perry files the first class action complaint against Wilmer Cutler Pickering Hale & Dorr LLP, with a jury demand. Assigned the next day to Judge Emmet G. Sullivan.
• July 29, 2026 — Emily Egan files a second class action, No. 1:26-cv-02663, initially assigned to Judge Dabney L. Friedrich. Her complaint attaches her actual notice letter as Exhibit A.
• August 6, 2026 — Egan files a Notice of Related Case pointing to Perry’s case; the case is reassigned on August 7.
• August 12, 2026 — a motion to appoint counsel and consolidate cases is filed in the lead case.
• August 18, 2026 — an order issues.
• August 19, 2026 — the lead docket carries a “Consolidation” remark, and the second case records a “Create Case Association.”

The lead case is now captioned In re: Wilmer Cutler Pickering Hale & Dorr LLP, Data Breach Litigation, No. 1:26-cv-02470 (D.D.C.). A caption change from a named plaintiff to “In re” is the visible signature of consolidation.

One honest limit: the full text of the August 12 motion and the August 18 order sits behind PACER’s paywall, and no free copy has been contributed to the public archive. We can see what the entries are called and what the docket did; we are not going to characterise what the order says beyond that.

This is the striking part. Six weeks after the letters were dated, there is still no authoritative public count.

The Egan complaint — a sworn federal filing — puts it this way: the breach resulted in the disclosure of the private information “of, upon information and belief, thousands to tens of thousands of individuals.” “Upon information and belief” is the phrase lawyers use when they are inferring rather than reporting. If the plaintiffs’ own lawyers had a firm number, it would be in the complaint.

The one figure we could verify against a primary government source is Washington State’s. The Washington Attorney General’s data breach register lists Wilmer Cutler Pickering Hale and Dorr LLP, breach start date 05/08/2026, 692 Washington residents affected, data involved: Name; Social Security Number; Student ID Number, reported 07/15/2026.

Aggregator sites currently report a nationwide total of roughly 95,000, assembled from six state filings with Texas said to account for about 80,500 of them. We could not verify that. The Texas Attorney General’s breach portal now sits behind a Salesforce login, and Maine’s viewer returned an authentication wall, so the two registries that would settle the question are no longer publicly readable. We are reporting the ~95,000 figure as unverified aggregator reporting, clearly labelled, precisely because we could not stand it up — and a number that cannot be checked should not be repeated as fact.

It is worth naming what that means: the public accounting of who was harmed in a breach at one of America’s most prominent law firms currently depends on which states still publish their registers.

The official notification describes a social engineering incident, not a systems intrusion: a staffer “mistakenly provided information to an unauthorized third party who misrepresented their identity.” The incident date is May 8, 2026.

The Egan complaint sharpens the point that this framing is a choice. It argues that the phrase “misrepresented their identity” “minimizes that it was Defendant’s own conduct,” and faults the letter for not specifying what the firm did to verify the requester’s identity. Egan is described as a client of the firm who was required to hand over her name, contact information, date of birth, Social Security number and payment or financial account information as a condition of obtaining services. The complaint pleads negligence-type claims and asks for court-ordered security improvements alongside damages.

On remediation, the complaint says the firm offered 24 months of credit monitoring and argues that is inadequate for the exposure of a Social Security number, which — unlike a card number — cannot be reissued on request. The enrollment deadline printed in the notification letter is October 31, 2026. If you received a letter, enrolling is free and the code stops working after that date; there is no reason to wait for the litigation to resolve before using it.

An unconfirmed trade-press report in August put the firm’s ransom payment at “at least $18 million.” WilmerHale has not confirmed it and we are not treating it as established.

To be unambiguous, because this is the question the search traffic is actually asking: there is no WilmerHale settlement. There is no settlement fund, no claims administrator, no claim form, no payout, and no deadline to claim money. Two class actions were filed weeks ago and have just been consolidated; no class has been certified and no court has ruled on the merits.

Cases like this take years, not weeks. The AMCA/LabCorp settlement finally approved this month covers a breach from 2018–2019 — seven years. That is the realistic clock.

The practical consequence: any website offering you a WilmerHale claim form, a payout estimate, or a “register now to join” flow is not connected to a court-authorized process, because none exists. During the gap between a notice campaign and an actual settlement, that gap is exactly what fraudulent and low-quality sites fill. If a real settlement is ever reached, it will have a court-authorized administrator and a named case, and the notice will come to you.

What is worth doing now is unrelated to the lawsuits: enrol in the offered monitoring before October 31, and consider a credit freeze at all three bureaus, which is free and does more against Social Security number misuse than monitoring does.