The security boundary that matters may be a single computer and the information its user can reach.
Holland & Knight and Squire Patton Boggs have disclosed security incidents, while Nelson Mullins faces a proposed class action following a reported breach. Holland & Knight says social engineering enabled unauthorized remote access to a firm computer. Nelson Mullins says an attacker accessed one user’s laptop and copied a limited number of accessible documents.
The accounts do not establish that all three incidents used the same method. They nevertheless make individual access and document exposure pressing questions for law firm management.
A limited incident can still expose sensitive information
The number of affected devices does not determine the significance of the information involved.
One lawyer or staff member may have access to materials from numerous matters. The consequences therefore depend partly on what that account or device can reach.
This is the practical distinction between containing an intrusion and limiting the information available during it.
A firm needs both.
Remote-access decisions deserve clear controls
A request for remote access may appear legitimate, urgent or technically necessary.
The useful control is a verification process that does not depend entirely on the requester’s persuasiveness. Staff should know how approved support works, how to confirm identity and when to pause a request.
The reported incidents do not establish the precise controls present at each firm. The broader lesson is to examine how authorization happens in practice.
A policy that staff cannot apply during a convincing interaction offers limited protection.
Litigation allegations remain unproven
Nelson Mullins has been sued over allegations that it failed to safeguard private information. The complaint is not a finding of liability.
Coverage should distinguish the firm’s account, the claimant’s allegations and any later court determination.
Canadian firms should also avoid assuming that a U.S. pleading establishes the obligations applicable to their own incident. Domestic reporting, privacy, contractual and professional requirements need separate assessment.
Five questions for firm leadership
The developments provide a useful basis for an internal review:
- How do users verify remote-support requests?
- What sensitive material can a single account access?
- How quickly can remote access be terminated?
- Who assesses a suspected disclosure and preserves evidence?
- How are notification decisions made and documented?
These questions concern organizational preparedness. They should not be treated as findings that the affected firms lacked particular safeguards.
Reporting culture is part of containment
Staff need to be able to report a suspected mistake promptly.
An organization that makes people reluctant to disclose an error can lose valuable response time. Clear escalation routes and practical training help turn an uncertain interaction into an actionable report.
For lawyers, cybersecurity is closely connected to the systems through which confidential work is performed. That makes it a management responsibility as well as an IT function.
The access granted to one person can define the exposure of many files.
Sources
Related coverage: OpenAI Engineer Charged Over Alleged Hidden Recording Device.