Holland & Knight, with about 2,200 lawyers, said social engineering enabled remote access to one computer. Squire Patton Boggs, with around 2,600 lawyers, reported unauthorised access to a limited set of information.

Social engineering bypasses technology

Both firms said services continued. At Nelson Mullins, a group targeting law firms allegedly accessed one user’s laptop and copied documents available from it.

A narrow technical incident can still contain exceptionally sensitive information. Continued service does not make a breach minor.

A provider extends the security perimeter

A company may secure its servers while sending documents to lawyers, accountants, insurers and consultants. Each becomes a custodian of risk.

Leaders need to know what data each provider holds, for how long and who can reach it. Contracts must be backed by verification, least privilege and shared notification plans.

Business continuity is not enough

Cybersecurity protects availability, integrity and confidentiality. Here operations continued while personal information was still exposed.

Organisations must establish what was viewed, whom to notify and whether documents could enable later fraud. Litigation can outlast the intrusion by years.

Least privilege, evidence and shared responsibility

Limiting each account, preserving useful logs and clarifying responsibilities across customers and providers are the priorities.

The question is no longer only whether your network is protected, but who else can access your data and prove its safeguards.

The digital chain of trust can break at a partner and from one device. Fewer standing privileges and collective incident management are the durable response.