Data at law firms Quinn Emanuel and McDermott exposed in cyber breaches

Two prominent U.S. law firms, Quinn Emanuel and McDermott, have disclosed recent data breaches involving information held for clients and other individuals. Neither firm identified who was responsible, and it was unclear whether the incidents were connected.

Quinn Emanuel said files were accessed on Aug. 14 after an unauthorized third party gained entry through social engineering. In a letter viewed by Reuters, the firm said some exposed information involved files belonging to short seller Muddy Waters, which Quinn had obtained during litigation in Florida.

“

A limited number of client documents were impacted and affected parties have been informed.

The firm said the incident involved unauthorized access to stored files in one software application through a temporarily compromised user account. “A limited number of client documents were impacted and affected parties have been informed,” Quinn said, adding that unauthorized access to its systems had ended.

“

We learned that Quinn failed to protect our sensitive information from social engineering hacking.

The disclosure added a new point of tension in a dispute between Quinn and Muddy Waters. The short seller had asked a judge to remove Quinn from a Texas lawsuit, arguing that the firm had previously represented it in related matters. Muddy Waters said, “We learned that Quinn failed to protect our sensitive information from social engineering hacking.” Quinn has denied the conflict-of-interest allegations and said one attorney briefly represented Muddy Waters in a different matter.

McDermott reported its breach to Vermont’s attorney general the previous week. The firm said files containing Social Security numbers and health data were affected. It described the event as “an isolated social engineering incident involving a single user and a limited number of documents,” and said it had investigated with cybersecurity experts and worked with law enforcement. “The matter has been resolved, and the firm’s systems remain secure,” McDermott said.

“

An isolated social engineering incident involving a single user and a limited number of documents.

Social engineering attacks manipulate people into revealing sensitive information or granting access to protected systems. At least three other firms, including Herbert Smith Freehills Kramer and Goodwin Procter, disclosed breaches to U.S. state regulators the previous month. WilmerHale was sued in July in a proposed class action over a breach that affected the firm.

“

The matter has been resolved, and the firm’s systems remain secure.