Kirkland & Ellis Targeted in Massive MOVEit Data Breach Lawsuit

Kirkland & Ellis, the country’s largest law firm by revenue, has been sued over a sweeping data breach that impacted some 2,600 companies.

The firm was named as a defendant in a lawsuit filed Friday in a Massachusetts federal court. It’s part of a multidistrict litigation stemming from a hack of Progress Software Corp.'s MOVEit file transfer software, which was breached by Russian cybercriminals in May. More than 300 defendants had been named in the litigation as of early this month, according to data from the US Courts system.

The hackers got a hold of files that Trilogy Home Healthcare transferred to Kirkland, which represented the company in its 2023 acquisition by a Humana Inc. subsidiary, according to the suit. All three companies were named defendants in the lawsuit. The data included personal identifiers such as Social Security numbers and health records, the suit says.

The ransomware group responsible for the attack listed the law firm’s name among affected organizations in late June last year, the lawsuit says. The firm didn’t notify Trilogy of the impact until October, according to the complaint.

Kirkland failed to implement and maintain reasonable and appropriate data privacy and security measures to protect the class members’ information from cyber-attacks, the suit says.

The data breach last year also impacted large firms including K&L Gates and Proskauer Rose, The American Lawyer reported.

A spokeswoman for Kirkland declined to comment on the lawsuit.

The case is Wilson v. Progress Software Company, D. Mass., No. 1:24-cv-11492, 6/7/24.