Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Practices & Industries

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Data Counsel

Welcome to the 12th edition of our annual Data Security Incident Response Report!

BakerHostetler releases 2026 Data Security Incident Response Report: Familiar threats, new pressures

ADventures in Law

FTC Issues Call for Comments on New Negative Option Rule

The 6 Pillars of the Trump Administration’s ‘Cyber Strategy for America’: The Devil Will Be in the Details

core/image

Historically, our data has reflected both continuity and change, fluctuating between radical shifts and the steady continuation of known risks. This year offers both—hence our title, "The Risk Remains (Mostly) the Same." When we began analyzing matter data in December 2025, AI’s role in incidents appeared limited. However, as we approached our March 2026 publication date, we clearly passed a tipping point. AI is moving beyond serving as just an “enhancer” for phishing: it is moving toward more sophisticated social engineering support and automation, and we are now seeing the rise of “vibe hacking” and autonomous coordination between agentic AIs. This volatility is further compounded by the current geopolitical climate. Adjacent to the conflict in Iran, will we see an uptick in disruptive cyber activity—from state-aligned hacktivism to renewed threats against critical infrastructure and global supply chains?

core/paragraph

We are likewise navigating a regulatory inflection point. With new AI mandates and privacy laws in the U.S. and EU moving from theory and guidance to active enforcement, the margin for error is disappearing. The risk landscape is dynamic, compounding, and increasingly structural—highlighted by the recent chipset vulnerabilities.

We have navigated emerging risks before, and we know there is no “magic bullet.” As EDR deployment matured and secured endpoints, attackers pivoted to identity-based access, drastically shortening the time from initial compromise to completion. While EDR remains essential, organizations now require additional strategies to address the enterprise risk created by AI with privileged rights to APIs and assets. Our competitive advantage remains our unique perspective. By managing incidents, litigation, and regulatory investigations across entities of all sizes, we provide the data-driven clarity needed to navigate this uncertainty. Whether you are deciding when to notify, choosing between vendors, or prioritizing compliance enhancements, we help you align your response with your specific risk appetite. Ultimately, the fundamentals still matter. Phishing has remained the leading cause of incidents for all 12 years of this report. The organizations that succeed in this landscape are those that execute the basics consistently and effectively. However, with regulators becoming more sophisticated—particularly regarding governance, risk assessments, and data retention—an enterprise-wide approach to risk has never been more critical.

We remain grateful for the strong relationships with our clients and our trusted external partners. I am immensely proud of the BakerHostetler team for the care and expertise that generate this report each year. We hope you find it insightful, use it as a road map, and invite you to reach out to any member of our DADM Practice Group with your questions.

Related Services

Featured Insights