Stevens & Lee data breach: what happened and what to do

Law firm Stevens & Lee found on June 28, 2021 that an unauthorized person had interfered with its systems. Reported figures reach 23,066 people. Exposed data included names, Social Security numbers and financial information. The firm offered free identity monitoring.

View all 13,177 breaches

Breach date: 28 Jun 2021
Made public: 8 Apr 2022
Affected: 23,066
Data exposed: Names, Social security numbers, Financial information
Last updated: 29 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Stevens & Lee is a law firm. In a filing to the Maine Attorney General, the firm said it discovered on June 28, 2021 that an unauthorized person had interfered with some of its systems. The state attorney general breach lists in California and Washington also carry notices from the firm, reported in April 2022.

The number of people affected grew as the review went on. The firm first reported 344 people in December 2021. The Maine Attorney General's listing later gave a total of 23,066 people, including 1,058 residents of Maine, as reported by DataBreaches.net. Many of them were customers of the firm's financial institution clients, not people who dealt with the firm directly.

Sources checked: maine.gov, databreaches.net, consumer.ftc.gov

Last verified against the official page: 29 Oct 2026

How we research this Report an error

What was exposed

A supplemental filing says the information included names, Social Security numbers and financial information. The notices don't say which financial details were involved for each person, so treat any account you hold with a financial institution that used this firm as a possible match.

What that means for you

A name together with a Social Security number is what a criminal needs to apply for credit in your name. Financial details can feed phishing that quotes real information to sound legitimate. The firm sent letters in waves, including on April 7, 2022, and offered free identity monitoring.

If you got a letter, the steps below apply. If you didn't, there is nothing in the sources to say you were affected, but you can still check your credit reports for free.

What to do if you were in it

1

Read the letter and use the monitoring offer

If you received a notice, it explains what was involved for you and how to enroll in the free identity monitoring the firm offered. Enroll before the deadline in the letter.
2

Freeze your credit at all three bureaus

A credit freeze blocks new accounts in your name and is free. Place it at Equifax, Experian and TransUnion. The FTC explains how freezes and fraud alerts work and which to pick.
3

Check your credit reports

Get your free reports at annualcreditreport.com and look for accounts or inquiries you don't recognize. Report anything wrong at identitytheft.gov.
4

Watch your financial statements

Look over bank, card and loan statements for charges you don't know. Tell the institution straight away if something looks off.
5

Expect phishing that mentions the breach

Calls, texts and emails may use details from the breach to sound real. Don't click links or give out information. Contact the company using a number from its own website.
6

Check whether you're in this and other breaches

Run a free Serus scan to see whether your email or phone number appears in known breaches.

Official filings

Washington Attorney General , filed 8 Apr 2022 : 1,028 people

Timeline

28 Jun 2021
The breach happened
8 Apr 2022
The company made it public
8 Apr 2022
Reported to the Washington Attorney General

Frequently asked

Was I affected by the Stevens & Lee data breach?

Affected people were sent a letter. The firm's clients included financial institutions, so some letters went to customers of those institutions. If you haven't had a letter, the sources don't say you were affected.

What was exposed in the Stevens & Lee breach?

A supplemental filing to the Maine Attorney General lists names, Social Security numbers and financial information.

How many people were affected?

The firm first reported 344 people in December 2021. The Maine Attorney General listing later gave 23,066, including 1,058 residents of Maine.

Should I freeze my credit?

If your Social Security number was in the breach, the FTC recommends considering a credit freeze or a fraud alert. A freeze is free and you can lift it when you need to apply for credit.