WilmerHale Data Breach: There Is No Settlement — but There Is One Deadline That Is Real
A staffer at Wilmer Cutler Pickering Hale and Dorr LLP handed client information to someone who had misrepresented their identity. Names and Social Security numbers were exposed. Search interest arrived before the facts did, and several sites now describe a settlement, a payout amount or a claim form. None of those exist. What does exist is a consolidated federal case that is still at its earliest stage, and a free credit-monitoring offer whose enrolment code stops working on 31 October 2026. This page separates the two.
Do This First: Free Monitoring, Code Dies 31 October 2026
If you received a notification letter, it contains a personal activation code for 24 months of Experian IdentityWorks, including $1 million in identity-theft insurance, at no cost. Enrolment closes 31 October 2026 at 11:59 pm UTC — the letter states plainly that the code will not work after that date. This is the only genuine deadline in the entire matter, it costs nothing, and it is entirely separate from any lawsuit. Enrolling does not waive any legal claim. If you have lost the letter, contact the firm's notification line rather than a third-party site: activation codes are personal and no legitimate service will issue one on your behalf.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Actually Happened
According to the firm's own notification letter, on 8 May 2026 a staff member "mistakenly provided information to an unauthorized third party who misrepresented their identity." This was social engineering — someone talked their way into the data — rather than a breach of the firm's systems. The information involved names and Social Security numbers obtained "through the course of providing certain legal services"; Washington State's filing additionally lists student identification numbers. Notification letters were dated 15 July 2026 and mailed through Return Mail Processing in Claysburg, Pennsylvania. The people affected are, in large part, not the firm's own staff but individuals whose data the firm held while acting as counsel — which is why many recipients had never heard of WilmerHale before the letter arrived.
Case Details
IN RE: WILMER CUTLER PICKERING HALE & DORR LLP, DATA BREACH LITIGATION, No. 1:26-cv-02470, United States District Court for the District of Columbia. Originally filed 14 July 2026 as Perry v. Wilmer Cutler Pickering Hale & Dorr LLP, asserting negligence and breach of contract, and since consolidated under an "In re" caption. The most recent docket activity on the public record is dated 19 August 2026 (checked 25 August 2026). No class has been certified and the court has issued no ruling on the merits.
Is There a Settlement? No — Here Is the Actual Posture
Who Is Affected — and Why Nobody Can Give You a Total
No official nationwide total has been published. Individual state Attorney General filings are public but do not agree: Washington's filing lists 692 residents, South Carolina's reports 14,496, and figures reported for Texas differ by more than a factor of ten between sources. For that reason this page does not state a national total — adding up inconsistent filings would produce a number that looks precise and is not. If you received a letter, you are affected regardless of what any total says; if you did not receive one, the firm's notification line is the only reliable way to check, and no third-party lookup tool has access to that list.
What Compensation Could Eventually Look Like
How This Case Got Here
- 1
8 May 2026 — the disclosure
A WilmerHale staff member provides information to an unauthorised third party who had misrepresented their identity, according to the firm's notification letter.
- 2
14 July 2026 — first complaint filed
Perry v. Wilmer Cutler Pickering Hale & Dorr LLP is filed in the U.S. District Court for the District of Columbia, No. 1:26-cv-02470, alleging negligence and breach of contract.
- 3
15 July 2026 — notification letters dated
Letters go out through Return Mail Processing in Claysburg, Pennsylvania, each containing a personal Experian IdentityWorks activation code.
- 4
July 2026 — firms announce investigations
At least four plaintiffs' firms, among them Migliaccio & Rathod, publicly announce investigations into the breach within days of the letters arriving.
- 5
7 August 2026 — the ransom report
Trade publication The Insurer reports that at least $18 million was paid to the Luna Moth extortion group, with CNA covering a $10 million primary insurance layer. WilmerHale has not confirmed this, and it is reported here as a media account rather than an established fact.
- 6
19 August 2026 — most recent docket activity
The consolidated case shows activity on the public docket as of this date. The firm has not answered the complaint, no class has been certified and no ruling has issued.
- 7
31 October 2026 — the only real deadline
Experian IdentityWorks enrolment closes at 11:59 pm UTC. After that the activation codes in the notification letters stop working. This deadline concerns the free monitoring only — it has nothing to do with any legal claim, and missing it does not forfeit one.
Three Things That Should Make You Close the Tab
The gap between a breach becoming public and a real settlement existing is measured in years, and that gap is where fraud lives. Three patterns are worth recognising immediately:
A claim form or portal for a WilmerHale settlement
There is no settlement, so there is nothing to claim. A form asking for your Social Security number to "verify eligibility" is collecting exactly the data that was already exposed, from people it has already been exposed to.
A specific payout figure
No amount has been proposed, negotiated or approved by any court. A site quoting "$2,500 per person" or similar is inventing it, usually to make a lead form feel urgent.
Anyone offering to retrieve your activation code
Experian codes are personal and tied to individual letters. The firm's notification line can help if a letter was lost. No third party can look one up, and asking to try is a way of harvesting identifiers.
Questions People Are Actually Asking
Is there a WilmerHale data breach settlement?
No. There is no settlement, no fund, no administrator and no claim form. A consolidated case is pending in federal court in the District of Columbia, filed in July 2026, and it is at its earliest stage. Sites describing a settlement are describing something that does not exist.
What is the 31 October 2026 deadline?
It is the cut-off for enrolling in the free 24-month Experian IdentityWorks membership offered in the notification letters, including $1 million in identity-theft insurance. The letters state that activation codes stop working after 11:59 pm UTC on that date. It is unrelated to any lawsuit — enrolling does not waive a claim, and missing it does not forfeit one.
Does signing up for the free monitoring stop me from suing later?
No. Accepting credit monitoring offered after a breach is not a release of legal claims. A release only happens if you later accept a court-approved settlement and do not opt out of it. The monitoring offer and the litigation are separate tracks.
How many people were affected?
No official total has been published. State filings that are public do not agree with one another — Washington lists 692 residents, South Carolina reports 14,496, and figures reported for Texas vary by more than a factor of ten between sources. Anyone quoting a confident national total is combining filings that contradict each other.
Did WilmerHale really pay an $18 million ransom?
That figure comes from a report by the trade publication The Insurer on 7 August 2026, which stated that at least $18 million was paid to the Luna Moth group with CNA covering a $10 million primary insurance layer. WilmerHale has not confirmed it. It is a media account, and it is worth noting that a ransom payment concerns the firm's own dealings with the attackers rather than any compensation to the people whose data was exposed.
I never was a WilmerHale client. Why did I get a letter?
The exposed information was obtained "through the course of providing certain legal services", meaning much of it belongs to people whose data the firm held while representing someone else — opposing parties, witnesses, employees of a client company, or members of a group involved in a matter. Receiving a letter without ever having hired the firm is expected here rather than a sign of error.
What should I do right now?
Enrol in the free monitoring before 31 October 2026 using the code in your letter. Place a free fraud alert or credit freeze with the three credit bureaus, which is separate from the Experian offer and costs nothing. Keep the notification letter itself — it is the document that proves you were affected, and any eventual claims process will ask for it. Then record anything unusual: attempted account openings, unfamiliar credit inquiries, tax-filing rejections, with dates.
How long until this case resolves?
Data-breach class actions commonly take two to four years from filing to any payout, and many are dismissed before reaching one. This case was filed in July 2026 and the defendant has not yet answered the complaint. Anyone offering a timeline more specific than that is guessing.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.