Two large firms disclose breaches exposing Social Security numbers

On October 9, Reuters reported that Holland & Knight and Squire Patton Boggs had disclosed breaches exposing Social Security numbers, following notices filed with Vermont’s attorney general on October 8. Holland & Knight attributed its incident to a social-engineering attack that enabled remote access, while a proposed class action involving Nelson Mullins alleges that data were taken from one laptop. For mid-sized firms, these incidents reinforce that AI governance cannot be separated from identity, endpoint and remote-access controls, particularly as connectors broaden the systems reachable from a single interface. Procurement reviews should therefore test conditional access, least-privilege scopes, audit logs and rapid revocation alongside model confidentiality terms.