Former Employee Sued Law Firm After Data Breach
A federal class action alleges Sheppard Mullin failed to protect sensitive information during a security event.
Updated on Oct. 8, 2026 in Cybersecurity
Live Poll
Do you trust that your personal information is adequately protected by the companies you use?
A former employee has filed a class action lawsuit against law firm Sheppard Mullin, alleging the firm failed to protect personal data during an August 31 security breach. The suit claims the incident exposed sensitive information for more than 1,000 individuals.
Why it matters
The case highlights the increasing liability law firms face regarding the stewardship of client and personnel data. It raises questions about the efficacy of cybersecurity training and the responsibilities of legal entities in preventing social engineering attacks.
The lawsuit seeks damages exceeding $5 million on behalf of a class of 1,000 individuals. Sheppard Mullin contends that the breach involved a limited document set rather than broad access to its internal network.
The players
Sheppard Mullin
A law firm with 1,200 attorneys that provides comprehensive legal services and manages sensitive client and personnel data.
The details
The data breach was identified as a social engineering event targeting an individual attorney at the firm. Social engineering involves manipulating individuals into performing actions or divulging confidential information, typically bypassing conventional digital security protocols. The lawsuit alleges that Sheppard Mullin failed to maintain adequate cybersecurity training, allowing the exposure of Social Security numbers and driver’s license information.
Timeline
August 31, 2026: A security breach exposed personal information.
October 7, 2026: The lawsuit was filed in federal court.
The Tech Race
The lawsuit reflects a growing trend of litigation aimed at holding professional service firms accountable for internal security failures. It follows a pattern of heightened scrutiny applied to data handling practices under California's unfair business practices law.
Individuals whose information was exposed in the August 31 breach may be eligible for inclusion in the class action if they meet the criteria defined by the filing. The legal proceedings will determine whether the firm is liable for damages as the case moves through federal court.
The takeaway
The case underscores the vulnerability of legal organizations to targeted social engineering campaigns. Observers should watch for future court rulings that define the extent of a firm's liability for human-factor security lapses.
Further reading
For more context on how firms are addressing data privacy risks, see our Cybersecurity section.
Live Poll
Do you trust that your personal information is adequately protected by the companies you use?
