Cyberbreach Leads to Legal Malpractice Claim

• Author: Jared H. Lorenz
• Pages: 8-8

federal distri ct court has

concluded tha t a plainti

suciently stated claims

based on a law f‌irm’s al -

leged mishan dling of a

client’s conf‌idential information. The

client allege d that the f‌irm breac hed

the duty of reason able care in fulf‌ill-

ing its professio nal and ethica l obli-

gations when the f‌i rm allowed a

hacker to breach the f‌i rm’s systems

and obtain a copy of the c lient’s asy-

lum application. The decision empha-

sizes the need to be ca utious in pro-

tecting clients’ information against

cyberattac ks, ABA Litigatio n Section

leaders say.

The litigation in Gu o Wengui v.

Clark Hill, PLC , et al., arose after a

well-known Chinese businessman and

prominent political dissident retained

Clark Hill to assis t him with an asy-

lum petition. Accor ding to the com-

plaint, he alle gedly warned the f‌irm

of his prominent p osition as a critic of

the Chinese reg ime, the risks associ-

ated with that position , and numerous

cyberattacks directed toward him and

his associates.

The defendant s agreed to take

special precautions in protecting the

plainti’s se nsitive conf‌idential infor-

mation. They ass ured him that “they

were qualif‌ied, capable, and compe-

tent to represent [the] plainti a nd to

protect his interes ts fully and profes-

sionally.” Relying on th ese commit-

ments regardi ng the protection of his

conf‌idential information, the plainti

hired the f‌irm to repre sent him.

According to the compl aint, in

September 2017, a hacker—presumably

the Chinese government—attacked

and accessed th e f‌irm’s computer sys-

tem. As a result, th e hackers obtained

and published a signif‌icant amount of

personal and conf‌idential information

belonging to the cl ient and his wife.

The f‌irm terminated its representa-

tion a few days later, explaining th at

because of the c yberattack, the f‌irm’s

Cyberbreach Leads to Legal

Malpractice Claim

members mig ht be required to serve

as witnesses for the plainti’s asylum

proceedings b ecause the hacking was

evidence of the poli tical persecution

from which their n ow-former client

sought asylum in t he United States.

The plainti ass erted that the

defendants we re liable for legal mal-

practice, brea ch of f‌iduciary duty,

and breach of contr act for allowing

his conf‌identia l information to be a

target for cybe rattack and subse-

quently withdrawin g from the matter.

Maintaining that the plainti’s allega-

tions failed to state plausible claims

for relief, the defen dants moved to

dismiss all count s.

The U.S. D istrict Court for the

District of Colu mbia held that the

plainti had su ciently pleaded

that the defenda nts breached their

duties in misrep resenting the man-

ner in which they woul d protect his

conf‌idential information and failing

to safeguard his inf ormation, which

could amount to incompetent rep-

resentation. W hile some courts have

held that failu re to prevent fore-

seeable cyberattacks constitutes a

breach of f‌iducia ry duty, this court

recognized that it did n ot need to f‌ind

that any corporatio n’s failure to pro-

tect against any fo reseeable cyberat-

tack, stand ing on its own, constitutes

a breach of f‌iducia ry duty.

The court allowe d the legal mal-

practice claim to pro ceed as the com-

plaint identif‌i ed a breach of the duty

of reasonable c are owed by attorneys

to their clients—s pecif‌ically, misrepre-

sentations mad e in order to secure a

prospective clie nt and the failure to fol-

low promised proce dures to adequately

secure conf‌idential information.

Litigation Secti on leaders warn of

the increasing d anger presented in this

area of cybersecurity. “Cyberattacks

are an area of increa sing concern in

which we can expec t to see much

more activity a nd heighten the need to

protect client information. Attorneys

By Jared H. Lorenz, Li tigation News Contributing Editor

need to be hyper-vigilant about

potential data breach and security

threats,” advises Richard A. Simpson,

Washington, DC , chair of the Section’s

Standing Committee on Lawyers'

Professional Liability.

The focus is on what t ype of infor-

mation is breach ed. “Where the infor-

mation being bre ached relates to the

law f‌irm itself, it typ ically would not

give rise to a claim. However, we are

seeing a rise in le gal malpractice and

breach of f‌iducia ry duty claims where

breaches resul t in the loss of cli-

ents’ personal information and data,”

observes Simpson.

Understanding the applicable duty

of care is impor tant for attorneys

addressing dat a security. “In deter-

mining what the st andard of care

is, several facto rs, including type of

case, the sens itivity of the informa-

tion, the repres entation of the cli-

ent, size of law f‌irm, an d available

resources, sho uld be considered,”

counsels Mich ael S. LeBo, Newport

Beach, CA , cochair of the Section’s

Professional Lia bility Litigation

Committee.

Section lead ers also note that it is

important to n ot overpromise sec u-

rity protections to c lients that the law

f‌irm cannot de liver on. “It is crucial to

understand what the f‌irm’s standard

procedures are in p rotecting data and

what you can do to take he ightened

protection and deve lop security pro-

tocols that are consis tent with the

potential threat an d the needs of the

client,” summa rizes LeBo.

RESOURCES

Kris ten L. Burge, “Hal f-Truths and

Hand Grena des: Defense Contrac tor

Sweeps Nonco mpliance under the Ru g,”

Litigation News (Mar. 11 , 2020).

Jose ph P. Beckman, “Law Firm

Cybersecu rity Breach Opens Do or to

Lawsuit,” Litigation N ews (Mar. 30, 2017).

8 | S ECTION OF LITIGATION

Published in Litigation News Volume 46, Number 3, Spring 20 21. © 2021 by the American Bar A ssociation. Repr oduced with permissi on. All rights reser ved. This informati on or any portion the reof may not be copie d or disseminated in any

form or by any means or sto red in an electronic da tabase or retrieval sy stem without the ex press writt en consent of the Amer ican Bar Associatio n.

ETHICS STR UGGLES IN THE LEGAL WOR LD