SecurityMay 2026 · 8 min read
The Biggest Law Firm Data Breaches — And What Metadata Had to Do With Each One
Law firms are the most targeted sector in cybersecurity after financial services. They hold M&A secrets, litigation strategy, privileged communications, and personal data — all in one place. Here are five of the most significant breaches and what they reveal about document security.
#1
Panama Papers — Mossack Fonseca (2016)
Records exposed
11.5 million documents
Root cause
Outdated WordPress plugin on client portal + unencrypted email server
Lesson: Client document portals are high-value targets. Every document in transit is a breach vector.
Metadata angle: Document metadata revealed the timing of transactions and internal drafter identities across decades of records.
#2
Grubman Shire Meiselas & Sacks (2020)
Records exposed
756 GB of celebrity client data
Root cause
REvil ransomware attack on firm servers
Lesson: Files stored on firm servers — even encrypted — are vulnerable to ransomware. Zero-retention is the only perfect defense.
Metadata angle: N/A — ransomware exfiltration, but metadata in leaked docs later revealed negotiation timelines.
#3
Campbell Conroy & O'Neil (2021)
Records exposed
Client personal data including SSNs, financial records
Root cause
Ransomware attack — specific vector not disclosed
Lesson: Even mid-size firms representing Fortune 500 companies are primary targets. Legal data has extreme black-market value.
Metadata angle: Post-breach forensics involved metadata analysis to determine exactly when files were accessed.
#4
Proskauer Rose (2023)
Records exposed
184,000 sensitive legal files publicly exposed
Root cause
Misconfigured Microsoft Azure cloud storage — exposed to open internet for months
Lesson: Cloud misconfiguration is more common than ransomware. Files in the cloud are never truly private.
Metadata angle: Metadata in exposed files revealed client names, matter codes, and drafter identities across the firm.
#5
Orrick, Herrington & Sutcliffe (2023)
Records exposed
638,000+ individuals' data
Root cause
Network breach — attackers accessed a file share
Lesson: Breach notification to 638,000 people means regulatory exposure in every state with breach notification laws.
Metadata angle: Timeline reconstruction relied heavily on file access timestamps and metadata logs.
The one thing that makes breaches worse: metadata
In every breach above, metadata turned a bad situation worse. Metadata in exposed documents revealed client identities, drafter names, matter codes, and timeline details that the documents themselves were supposed to keep confidential. Stripping metadata before documents reach any server — cloud storage, email, client portal — limits what attackers can learn even when they get in.
Zero-retention is the strongest breach defense.
If your files never reach a server, a server breach can't expose them. ShieldDrop processes everything locally.
Get the Attorney Privacy Digest
Monthly: metadata case law updates, state bar rulings, and new tool announcements. No spam.