Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 11 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Silicon Valley

Washington, D.C.

<img style="max-width: 100%;height: auto;max-width: 100%;height: auto" loading="lazy" class="alignright size-medium wp-image-2582" src="https://www.thelawforlawyerstoday.com/wp-content/uploads/sites/754/2016/05/Computer-snooping-250x300.jpg" alt="" width="250" height="300">A prominent Chinese dissident may proceed with his malpractice case against a law firm based on allegations that the firm failed adequately to protect his personal data from hackers, a Washington, D.C. district court said in an <a href="https://filehost.thompsonhine.com/uploads/Clark_Hill_opinion_eb66.pdf">opinion</a> on February 20.&nbsp;&nbsp;In his $50 million suit, the plaintiff, Guo Wengui, alleges that after he retained the firm, someone (assumed to be associated with the Chinese government) penetrated the firm&rsquo;s computer servers, gained access to his confidential information and published it on the Internet.
The district court turned back the firm&rsquo;s motion to dismiss and allowed most of Wengui&rsquo;s claims to go forward.&nbsp; The case bears watching as cyberattacks <a href="https://www.law.com/americanlawyer/2019/02/20/law-firms-still-a-great-target-as-us-firm-falls-victim-to-alleged-chinese-hack/">increasingly target</a> law firms, and legal IT teams struggle to stay one step ahead of security threats.
&ldquo;Expect to be&rdquo; a target
Wengui alleged in his complaint that he is a well-known dissident who exposed corruption and human rights abuses of the Chinese ruling party while he lived there.&nbsp; After he fled China in 2015, Wengui came to New York.&nbsp; Nonetheless, he alleged, the Chinese government has continued to harass him with demonstrations outside his home and a &ldquo;negative propaganda campaign.&rdquo;&nbsp; He applied for political asylum and retained the law firm for potential assistance..
According to the complaint, the firm assured Wengui that it could protect his interests.&nbsp; Wengui alleges that he warned the firm of the risks attendant to his status as a prominent dissident, including that the firm &ldquo;should expect to be subjected to sophisticated cyber attacks,&rdquo; and that it should &ldquo;take special precautions&rdquo; to prevent intrusion into and disclosure of his sensitive confidential information.
Nonetheless, Wengui alleged,&nbsp;in September 2017, the firm&rsquo;s computer system was penetrated, and the hackers obtained Wengui&rsquo; s and his spouse&rsquo;s sensitive personal information, including his asylum application.&nbsp; The information was published and disseminated on social media, the complaint says.
Was cyber-breach a breach of duty?
The court held that Wengui pleaded viable claims for malpractice, breach of fiduciary duty and breach of contract.&nbsp; Wengui&rsquo;s claim that the firm&rsquo;s information security measures were inadequate and unreasonable rested on more than the mere fact that &ldquo;there was a cyber incident,&rdquo; the court said.&nbsp; And while it did not find that all failures to protect against a foreseeable cyberattack would be actionable standing on their own, the court said that here, there were additional factors:&nbsp; Wengui &ldquo;sufficiently&rdquo; pleaded that the firm had misrepresented the manner in which it would protect his information in order to obtain his legal business.
Wengui also alleged that, despite the firm&rsquo;s promise to take special precautions, it violated his express instructions by placing his confidential information on its servers and conveying it by e-mail, and that he was actually harmed when the Chinese government used the allegedly-hacked information as part of its &ldquo;persecution and harassment&rdquo; against Wengui.
These factors also pointed to the breach of the duty of reasonable care sufficient to sustain a malpractice claim at the pleading stage, and to support a breach-of-contract claim (although the latter &ldquo;just barely,&rdquo; said the court).
Corporate duty to protect?
In at least two cases, courts have gone so far as to hold that corporations have a duty to protect against a third person&rsquo;s criminal act if the organization has a reason to anticipate the crime, and breaches its duty to customers if it fails to prevent a foreseeable cyberattack.&nbsp; See Attias v. CatreFirst, Inc., 365 F. Supp. 3d 1, 21 (D.D.C. 2019); In re Arby&rsquo;s Rest. Grp. Inc. Litig., 2018 U.S. Dist. LEXIS 131140 (N.D. Ga. Mar. 5, 2018).&nbsp; In 2016, two plaintiffs filed a bellwether class action in the Northern District of Illinois against a law firm in advance of any cyber-breach, a development we <a href="https://www.thelawforlawyerstoday.com/2016/12/data-breach-report-says-biglaw-is-most-likely-to-be-hit-and-first-cybersecurity-complaint-is-unsealed/">discussed</a> and one that <a href="https://www.law.com/americanlawyer/almID/1202774361560/">worried commentators</a>.&nbsp; The putative plaintiffs later <a href="https://www.abajournal.com/news/article/suit_claims_class_action_firm_is_using_the_courts_to_further_its_own_self_a">withdrew the complaint</a>, and the law firm targeted in the suit later sued the putative plaintiffs&rsquo; lawyers.
We&rsquo;ve written before about the <a href="https://www.thelawforlawyerstoday.com/2015/08/legal-departments-among-most-likely-to-fall-for-phishing-says-report/">reported susceptibility</a> of law firms to data security breaches.&nbsp; And late last year, the influential Sedona Conference proposed a new &ldquo;<a href="https://www.thelawforlawyerstoday.com/2019/08/do-we-need-a-new-data-breach-privilege-thoughts-on-the-sedona-conference-proposal/">data breach&rdquo; privilege</a> to protect information prepared in a cybersecurity context, even when not involving communication with an organization&rsquo;s lawyer.
Negligence claims against law firms for information security breaches are sure to proliferate in the future as cybercriminals become ever more skillful and experienced in their attacks.&nbsp; All lawyers should take note.

core/freeform

Ethics

Partner

Thomas F. Zych

Legal Ethics, Professional Responsibility and the Business of Law

Malpractice suit for document hack that exposed client info can proceed, D.C. district court says