Data From Hundreds of Law Firms Left 'Exposed' on Open Platform
The data from some of the largest firms in the world included security-hashed passwords, partial security authentication details and business emails.
May 05, 2020 at 10:01 AM
3 minute read
The original version of this story was published on Law.com International
Detailed and potentially sensitive information uploaded by firms including Weil, Gotshal & Manges, White & Case, Baker McKenzie and DLA Piper was left "exposed" on an open database platform, according to a report by a cybersecurity firm.
The cache of data, which included Companies House forms, partial security authentication details, business email addresses and encrypted passwords, were accessible on a historic database owned and operated by British tech giant Advanced Computer Software, the report says.
Data from hundreds of law firms was on the platform, according to the post by TurgenSec. Other top firms affected were Hogan Lovells, Clifford Chance, Slaughter and May, Fieldfisher, Dentons UKMEA, Addleshaw Goddard and legacy Olswang—now part of CMS.
The company lists more than 190 law firms with data on the platform, including 49 with primary data on the platform including hashed passwords, usernames and IDs.
Clifford Chance confirmed in a statement that a review had taken place, while a person with knowledge of the situation said DLA Piper had launched a "full and thorough" investigation following the incident.
According to a post by TurgenSec, the Advanced team interacted with an open server and did not use unauthorized credentials, brute force password guessing or any other unlawful process.
The cybersecurity firm added that the identified databases appeared to contain information relating to the staff of legal firms, and in some cases, potentially sensitive data relating to authentication on behalf of clients.
In a statement, Advanced director of security and compliance Justin Young said the firm had taken immediate steps to "address the issue, secure the data and make contact with the small number of affected customers."
Young added that the data in question related to commercial property transactions and was largely of public record on Companies House and predated 2017.
Other data on the platform consisted of business email addresses, passwords and security verification responses. Young added that all passwords on the affected platform were in secure hashed form, and noted that "security verification responses consisted of the first three letters of the response only and therefore resulted in a very limited amount of additional information being discernible from the platform."
"None of the data is deemed sensitive or special category under current legislation. We have taken legal advice to verify our position," Young said.
A spokesperson for Clifford Chance added: "We take the security of our data and systems, including those provided by third parties, extremely seriously. Our detailed analysis, based on our own review and on input from the supplier, has confirmed the discernible data from the firm was limited and historic and only partially visible. Any client data was already a matter of public record and no longer private or confidential."
Slaughter and May and Hogan Lovells declined to comment. Weil, White & Case, Baker McKenzie, Fieldfisher, Dentons UKMEA, Baker McKenzie, Addleshaw Goddard and CMS had not responded to requests for comment at the time of publication.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllCan Law Firms Avoid Landing on 'Enemy' List During the Trump Administration?
5 minute readVisa CLO-Turned-Vice Chair Seeing Payoff From Expanded Role
Ex-CFO of San Francisco Law Firms Pleads Guilty to $1.3M Embezzlement Scheme, DOJ Announces
Boies Schiller Increases Federal Clerkship Bonus to $150K Amid Hiring Uptick
Law Firms Mentioned
Trending Stories
- 1City Bar Presents Thomas E. Dewey Awards to Outstanding NYC Prosecutors
- 2NC Solicitor General Park Withdraws His 4th Circuit Nomination
- 3Trump-Appointed Judge Presides Over NASCAR Antitrust Dispute Under Case Reassignment
- 4CFPB Orders Big Banks to Limit Overdraft Fees to $5. But Will Its Edict Stick?
- 5FIFA Faces Legal Challenge Over Winning Saudi World Cup Bid
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250