Chieftains of corporate America have long feared the financial and reputational fallout from a hacking breach. But a class action suit unveiled against a law firm last week could add to their data security anxiety. The suit claims that companies and law firms should be held accountable for lax security measures even if their customers’ data never falls into a hacker’s hands.

Some lawyers are skeptical that a court will agree to a new, wide-ranging theory that could essentially hold companies legally accountable for staying up-to-date with the latest data security protocols.