Major U.S. law firms Quinn Emanueland McDermott Will & SchulteThey disclosed the data breaches that occurred in each case and reported them to law enforcement. Since both incidents were linked to a single user and social engineering, this demonstrates that a single user account—rather than a massive system—can serve as the starting point for an attack.
At Quinn Emanuel, some client documents were exposed through a temporarily compromised account, and at McDermott, some files containing Social Security numbers and health information were affected. So far, neither the perpetrators behind the two incidents nor any connection between them has been identified.
Law firms are high-value targets for attackers because they handle corporate transactions and litigation while also holding the personal information of employees and clients. This incident highlights that simply increasing security equipment is not enough; it also requires proper management of account privileges, user authentication procedures, and the segregation of sensitive documents.
| Confirmed as two separate incidents
According to Reuters, the two law firms each confirmed the recent breaches and reported them to law enforcement. It has not been disclosed who carried out the attacks or whether the two incidents are related.
Just because similar methods were mentioned in two different cases doesn't mean we can conclude that they were carried out by a single attack group. The only commonalities identified so far are that the attacks involve social engineering—tricking users into granting access—and a single user account.
| Quinn Emanuel is a temporary hijacked account
Quinn Emanuel states that files stored in a software application One user account that was temporarily compromised...revealed that unauthorized access occurred through [...]. They explained that a limited number of customer documents were affected, that the relevant parties had been notified, and that there is currently no ongoing unauthorized access.
A letter dated August 25, as confirmed by Reuters, stated that a third party had gained access on August 14 through social engineering, and that some files related to the U.S. short-selling firm Muddy Waters had also been exposed. The full extent of which documents were copied and how many were copied was not disclosed.
| Impact on Personal and Health Information at McDermott
McDermott stated that it responded to a separate social engineering incident involving a single user and a limited number of documents. The company explained that it conducted an investigation with the assistance of external cybersecurity experts and cooperated with law enforcement agencies, adding that the incident has been resolved and the systems are secure.
A public list submitted to the Vermont Attorney General identifies Social Security numbers and health information as the types of data that were compromised. Fifteen Vermont residents were included in the notification list, but since these are figures reported by that state, they cannot be taken to represent the total number of affected people nationwide.
| The Judgment of Those Targeted by Social Engineering
Social engineering is a method of creating a situation that appears trustworthy—such as through email, phone calls, or fake login screens—to trick users into revealing their passwords, authentication information, or granting access. Even without any technical vulnerabilities, it's possible to take over an account by exploiting people's trust and work habits.
In particular, law firm staff frequently handle various files and links sent by clients, courts, and outside experts. It’s easy to mistake requests that take advantage of tight deadlines or confidentiality requirements for routine work, so, We need more than just training; we need a procedure to double-check suspicious requests.
| Why a Single Account Leads to So Many Documents
Cloud-based document management systems improve work efficiency, but when multiple cases and client records are consolidated into a single account, the impact of an account breach becomes more severe. If a user can access documents that aren’t actually necessary for their work, an attacker could also exploit those same permissions.
By narrowing the scope of access in accordance with the principle of least privilege and requiring separate approval or additional authentication for sensitive documents, you can limit the damage. It's also important to monitor for activities such as opening or downloading large files from locations or devices that are different from usual.
| Why Law Firms Are Attractive Targets
Large law firms store a wide range of data, including merger and acquisition materials, confidential litigation strategies, contracts, financial information, employee information, and even medical records. Attackers can exploit this data for fraud, extortion, further phishing attacks, or corporate data theft.
Reuters recently reported that other major U.S. law firms have also reported data breaches to state regulators. This should be viewed not as a problem specific to individual companies, but as a supply chain and account security risk common to the entire professional services industry.
| The extent of the damage and measures to prevent recurrence are key
The two law firms stated that they responded to the incident and notified those involved, but they did not disclose the total number of people affected, the types of files involved, whether the attackers actually extracted any data, or how long the accounts were exposed. The company's statement that the incident has been resolved does not necessarily mean that the full extent of the damage has been determined.
Going forward, we’ll have to see if measures to prevent a recurrence—such as the release of investigation findings, additional notifications, strengthened authentication, reduced account privileges, and the retention of document access logs—are implemented. The key lesson from this incident is that even with robust security systems, a single erroneous authorization can lead to the exposure of sensitive data, so The point is that we need to protect people, accounts, and documents all at once.
Tags
#QuinnEmanuel #McDermott #DataBreach #Cybersecurity #Social Engineering #Privacy Protection #Law Firm Security #Account Security #Data Leak #Social Security Number #Health Information #Phishing Prevention
