A law firm can lose control of sensitive documents without an attacker gaining access to its network.
That is the distinction in Sheppard Mullin’s account of an August 31 security incident. In its notification, the firm says a single attorney was targeted through social engineering and disclosed certain documents to an unknown third party. It says there was no unauthorized access to or compromise of its systems or network. Firm notification
A former employee has since filed a proposed class action in California federal court. The complaint alleges that the incident exposed personal information. Those allegations have not been adjudicated. Law360
The case illustrates why law firm cybersecurity must address both infrastructure and ordinary document-handling decisions.
Network security does not cover every disclosure
Security discussions often begin with credentials, malware and unauthorized access.
Those controls matter. They do not address every route by which information can leave a firm.
A persuasive request may cause an authorized person to send documents through an otherwise functioning system. The technical environment can remain uncompromised while the information is disclosed improperly.
That is a general risk illustrated by the firm’s account. The public notice does not justify speculation about the precise message, identity or method used in this incident.
Liability remains unresolved
The proposed lawsuit should not be described as a finding that Sheppard Mullin failed to protect data.
The distinction between a reported incident, a claimant’s allegations and a court’s conclusions is essential.
A notification records an organization’s account of what happened and its response. A complaint advances allegations and claims. Neither substitutes for an adjudicated determination of responsibility.
For Canadian firms, the useful comparison concerns controls and evidence rather than assuming that California causes of action apply domestically.
Document release is a governance issue
The practical question is how a firm verifies that a request is legitimate before releasing sensitive material.
Responsibility may sit across lawyers, support staff, IT, privacy personnel and management. That makes a clear process important: who verifies the requester, who approves an unusual disclosure and who responds if someone discovers a mistake?
A policy must also work under time pressure. Staff need permission to pause and verify a request that appears urgent or authoritative.
Five controls worth reviewing
Canadian firms can use the incident to examine their own processes:
- Independent verification: Confirm unusual requests through an established contact route.
- Disclosure authority: Identify who can approve the release of sensitive documents.
- Information access: Limit unnecessary access to sensitive records.
- Prompt escalation: Give staff a clear way to report suspected mistakes immediately.
- Incident evidence: Preserve relevant communications and document the response.
These are editorial practice suggestions, not findings about which controls were present or absent at Sheppard Mullin.
Human decisions belong in the security model
Calling an incident “human error” can obscure the organizational questions behind it.
Training, approval routes and practical verification processes shape the decisions people make. A useful review examines those conditions alongside individual conduct.
Cybersecurity must protect the moment a legitimate user decides to send a document.
Related coverage: read our analysis of confidentiality and lawyers’ use of generative AI.
Sources: Firm notification · Law360.
Related coverage: OpenAI Alleges Departing Employee Took Product Files to Apple.
Related coverage: ICO Acts Against Metropolitan Police Over Unapproved Data-Sharing Platform.