People whose personal data was exposed in the Thompson Coburn LLP breach can file claims for up to $5,000 in documented losses, but the window closes on July 23. The breach itself occurred on May 28 and May 29, 2024, when an external hack compromised the law firm’s systems. The firm did not discover the intrusion until November 19, 2024, and consumer notifications went out on December 31, 2024, creating a timeline that raises questions about how the claims deadline was chosen and how much time affected individuals actually have to act.
Why the July 23 claims deadline demands attention now
The gap between when the breach happened and when people learned about it is striking. Thompson Coburn’s systems were compromised over two days in late May 2024, but the firm did not identify the intrusion until nearly six months later, on November 19, 2024, according to Maine regulators. Consumer notices followed on December 31, 2024. That means affected individuals received their first official warning roughly seven months after hackers accessed their information.
The July 23 claims deadline falls almost exactly 14 months after the original breach dates. One reading of this timing is that it was pegged to roughly one year from the May 2024 incident rather than to a standard notice-triggered response period. If the deadline had been set based on when consumers were actually told about the breach, it would more logically fall in late 2025 or early 2026. The compressed schedule puts pressure on anyone who received a notice to gather documentation of financial harm quickly, particularly those who may not have connected suspicious account activity to the breach until the notification arrived months after the fact.
For affected individuals, the practical question is straightforward: anyone who suffered identity theft, fraudulent charges, or other financial harm traceable to the exposed data needs to compile receipts, bank statements, and related records well before July 23. Waiting until the last week risks missing the cutoff entirely.
State filings trace the breach to a two-day external hack
Three state attorneys general have published records that confirm the basic facts of the incident. The California breach index lists the breach dates as May 28, 2024 and May 29, 2024, and includes a copy of the sample notice sent to consumers. Massachusetts posted the firm’s official notice of data event describing the incident and providing contact information. Maine’s filing adds the most granular timeline: breach occurrence on 05/28/2024, discovery on 11/19/2024, a description categorizing the incident as an external system breach and hacking event, and a consumer notification date of 12/31/2024.
Taken together, these records establish that hackers gained access to Thompson Coburn’s systems through an external attack, not through an insider error or accidental exposure. The firm is a large national law firm, which means the compromised systems could have contained sensitive client data, employee records, or both. The state filings do not specify the exact types of personal information exposed or the total number of affected consumers, leaving those details to the individual notification letters mailed to people whose data appeared in the compromised environment.
What the $5,000 claims cap actually covers
The offer of up to $5,000 in reimbursement is limited to documented, out-of-pocket losses that can reasonably be linked to the breach. In practice, this usually means unreimbursed fraudulent charges, costs to correct credit records, fees for replacing identification documents, or professional expenses tied to resolving identity theft issues. People who experienced fraud that their bank or card issuer already refunded may not see additional compensation unless they can show other direct costs.
Because the breach notice went out months after the intrusion, some victims may have already spent time and money dealing with unexplained account problems without realizing a law firm hack was the underlying cause. Those earlier expenses can still be relevant, but only if they are carefully documented and can be connected to the types of information believed to have been exposed.
Steps affected individuals should take before July 23
Anyone who received a Thompson Coburn data breach letter should start by reading it closely and saving both the physical and digital copies. The notice typically explains what categories of information were involved for that specific person and outlines the process for submitting a claim. From there, individuals should pull recent bank and credit card statements, credit reports, and any correspondence with financial institutions about disputed transactions.
It is also important to keep a simple timeline: when the person first noticed suspicious activity, when they reported it, what responses they received, and what costs they incurred along the way. Organizing this information now makes it easier to complete the claim form accurately and to respond quickly if the claims administrator asks for clarification or additional proof.
Even people who have not yet seen signs of fraud should consider using any credit monitoring or identity protection services offered in connection with the breach. While these services do not erase the risk created by the hack, they can provide earlier warning of misuse and create additional records that may be useful if problems emerge closer to the deadline.
Why timing and documentation will shape outcomes
The Thompson Coburn breach illustrates how long it can take for organizations to detect and investigate cyber intrusions, and how that delay can compress the time available for victims to respond. With the claims period ending on July 23, individuals have a finite window to turn scattered receipts and emails into a coherent record of loss. Those who act early are more likely to meet the documentation standards and avoid last-minute obstacles, while those who wait may find that the combination of a long-ago breach and a fast-approaching deadline leaves little room to secure compensation for the disruption and financial harm they have already experienced.
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
