DQ — Firm Survives Disqualification Motion in Control Suit, Law Firm Data Breach Class Actions Filed, New Law Firm Data Breaches Revealed
Posted on“Boston firm hit with pair of data breach class actions” —
- “A Boston law firm is facing two class actions alleging that a failure to take appropriate cybersecurity measures resulted in a March 2024 data breach that exposed nearly 13,000 clients, former clients and others to the risk of identity theft.”
- “‘Defendant disregarded the rights of Plaintiff and Class Members by … intentionally, willfully, recklessly, or negligently failing to take adequate and reasonable measures to ensure that its network servers were protected against unauthorized intrusions,’ states the complaint in Frawley v. Casner & Edwards, filed in U.S. District Court in Boston.”
- “A second putative class action filed days later on June 2 alleges the law firm exacerbated the potential risks from the 2024 breach by waiting until last month to begin informing those whose personally identifiable information had been compromised.”
- “‘Casner took over a year before informing Class Members even though Plaintiff and thousands of Class Members had their most sensitive personal information accessed, exfiltrated, and stolen,’ the complaint in Glavin v. Casner & Edwards states.”
- “Casner managing partner Michael F. Zullas said his firm had yet to be served with the complaint in Glavin. He said the breach involved only a ‘small, separate’ segment of his firm’s computer database.”
- “‘It didn’t affect the majority of our data,’ Zullas said. ‘As soon as we became aware [of the breach], we engaged in a lengthy investigation to determine exactly what happened, we notified federal law enforcement, [and] we implemented additional technical safeguard to help ensure this wouldn’t happen. And out of an abundance of caution, we identified anyone whose data may have been tangentially affected, notifying each of those individuals.'”
“The Casner breach is an example of a shift in the nature of threats from the ransomware attacks that were the bane of law firms several years ago, said Brian J. Lamoureux, a Providence litigator who handles cyber cases. That shift occurred once law firms and other businesses figured out they could defeat ransomware attacks by continuously backing up their data, he said.” - “‘Once cyber hygiene and cyber backups became [the norm], bad actors shifted over to what is called the ‘double extortion’ scheme where they not only get access to your system but then threaten the release of customer, client and patient data,’ Lamoureaux explained.”
- “Lawsuits like the ones facing Casner & Edwards are not surprising, according to Boston attorney Seth P. Berman. ‘As we have seen over the past several years, we can expect to see that many law firms and other companies will get hacked and will get data stolen,’ Berman said. ‘There really isn’t a perfect way to protect yourself from this problem.'”
- “The negligence per se claim is premised on an alleged breach of duties imposed under the Federal Trade Commission Act, 15 U.S.C. §45. According to the complaint, Casner failed to use reasonable measures to protect Personally Identifiable Information entrusted to it in violation of §5 of the FTC Act, which prohibits ‘unfair … practices in or affecting commerce.'”
“The Frawley complaint similarly alleges that Casner breached duties established under 15 U.S.C. §45, FTC guidelines, and other industry standards.” - “In terms of liability for a data breach, the standard of care for law firms is one of ‘reasonableness,’ Lamoureux said. ‘Did the law firm take commercially reasonable steps to avoid the incident?’ he said. ‘That’s a moving target. Two-factor authentication was not a thing 10 years ago. Now, if you don’t have two-factor authentication or other backup security measures, someone can get on the witness stand and testify that that fell below the standard of care depending on the type of business.'”
- “‘Just the idea of having to let your clients know that you were victimized creates enormous trust and relationship issues, because lawyers, like doctors, are in the ‘secrets’ business,’ he said. ‘We get paid and are obligated to hold secrets.’ “
“Goodwin, Eckert Seamans Faced Data Breaches in April” —
- “Two Am Law 200 firms suffered data breaches in April, according to data security notices submitted to the Maine Attorney General’s Office.”
- “Goodwin Procter experienced a data breach on April 29 that impacted the personal information of approximately 363 individuals. The second firm, Eckert Seamans Cherin & Mellott, was sued Tuesday over its own data breach dating to April 17 that impacted the information of over 9,000 individuals associated with a singular client, the Wheeling Jesuit University.”
- “According to Goodwin’s notice, which was filed on the firm’s behalf by Erez Liebermann of Debevoise & Plimpton on July 2, the firm discovered the breach on May 2. The letter indicates that the breach was caused by an incident related to a firm vendor, Commvault, and that the breach impacted a small number of firm email accounts; the firm is offering two years worth of credit monitoring through Experian.”
- “Pittsburgh-based Eckert Seamans, meanwhile, faces a negligence suit in the U.S. District Court for the Western District of Pennsylvania. The suit claims that the names and Social Security numbers of approximately 9,400 alumni of Wheeling Jesuit University alumni were exposed in the data breach as a result of the firm failing to update its technology security practices.”
- “A data breach notification letter submitted to the attorney general of Maine confirms that the Eckert incident occurred on April 17 and additionally indicates that the firm did not discover the data breach until May 20. The data breach notification further indicates that the firm did not notify those impacted in the breach until June 18, which is also noted in the suit.”
- “‘Plaintiff’s notice letters were dated nearly one month after Defendant discovered the Data Breach and nearly two months from the actual breach,’ the suit, filed by attorneys from Kimmel & Silverman and EKSM LLP on behalf of Wheeling Jesuit University alumna Lara Williams, reads, alleging that the delayed notification impacted the plaintiffs’ ability to mitigate the breach’s harm.”
- “The suit further alleges that Eckert Seamans did not adequately protect its clients’ confidential information, thereby contributing to the breach.”
- “The firm ‘negligently maintained its computer network system in a condition that failed to meet the industry standards recommended by the ABA, the FTC, industry guides, and information technology security recommendations and manufacturers,’ the suit alleges.”
- “‘These foregoing frameworks are existing and applicable industry standards in the legal industry, and Defendant failed to comply with these accepted standards, thereby opening the door to and causing the Data Breach,’ the suit claims. ‘As the result of computer systems needing security upgrading, inadequate procedures for handling emails containing ransomware or other malignant computer code, and inadequately trained employees who opened files containing the ransomware virus, Defendant negligently and unlawfully failed to safeguard Plaintiff’s and Class Members’ Private Information.'”
“Judge Won’t Disqualify Attys In AmeriMark Control Dispute” —
- “A Utah magistrate judge declined to disqualify attorneys from Venable LLP and Parsons Behle & Latimer PC from representing Swiss plaintiffs Capana Swiss Advisors and AmeriMark Automotive in a lawsuit over who controls AmeriMark Group, finding there is no clear conflict of interest and that disqualification would unfairly disrupt the case.”
- “Defendants Rymark Inc. and Nicholas Thayne Markosian asked the court in January to remove the attorneys from the case, claiming there was a conflict of interest because the attorneys were representing both Capana and AmeriMark.”
- “The lawsuit boils down to a dispute over who controls AmeriMark Group and AmeriMark Automotive. Capana claims it has about 13 million shares in AmeriMark Group or a 65% stake, but Markosian alleges in a countersuit that those 13 million shares were stolen from him and that he is, in fact, the largest shareholder in the company.”
- “‘In the ordinary course, AmeriMark would be agnostic as to the dispute between Capana and Mr. Markosian … but in this litigation, AmeriMark is represented by the same attorneys representing Capana,’ the January motion said. ‘Those attorneys are being paid by Capana, not AmeriMark. The upshot is that AmeriMark is essentially at the mercy of Capana and Capana’s attorneys. It is not receiving independent or unbiased legal advice.'”
- “However, in an order issued June 6, U.S. Magistrate Judge Cecilia M. Romero said the defendants have not met their burden of demonstrating a conflict of interest or that there has been an ‘interference’ in the suit from Capana paying the legal fees.”
- “Additionally, the judge said that even if the defendants had demonstrated a sufficient conflict, their motion would still fail because they did not ‘diligently pursue disqualification,’ and did not file their disqualification in a timely manner.”
“John Worden of Venable LLP said: ‘The motion was untenable from day one. It was strategic and it was filed by lawyers who when they filed, they were also representing multiple parties and entities. And so by the terms of their own motion they should have been disqualified, too… We never feared much that the judge would grant it, but it was an inconvenience … we are hopeful that the new motions moving forward will be of a more substantive nature,’ Worden added.” - “The attorneys who filed the disqualification motion in January on behalf of Rymark and Markosian are no longer serving as their counsel. According to the court docket, the defendants alerted the court in May to a substitution in their legal representation.”