Sheppard Mullin Richter & Hampton is facing a proposed class action in California federal court after a cybersecurity incident allegedly exposed sensitive personal information, raising questions about law firms’ responsibilities to protect confidential client and employee data.
The lawsuit, filed on 7 October 2026 in the US District Court for the Central District of California, was brought by former employee Pena-Emilia Williams. It alleges that the international law firm failed to maintain adequate cybersecurity safeguards and employee training, allowing confidential information to be disclosed during an August security incident.
According to the firm’s notification to state authorities, the incident occurred on 31 August when an attorney became the target of a sophisticated social engineering attack. The deception resulted in certain documents being disclosed to an unknown third party.
Sheppard Mullin discovered the incident on 1 September and launched an investigation involving external cybersecurity specialists. The firm subsequently notified law enforcement and began identifying individuals whose information appeared in the affected documents.
The information potentially compromised included Social Security numbers, driver’s licence numbers and other personal identification details. Williams alleges that the disclosure exposed affected individuals to increased risks of identity theft and financial fraud.
However, Sheppard Mullin has emphasised that the incident was limited to documents handled by one attorney and did not involve unauthorised access to its computer systems or wider network.
The firm has notified affected individuals and offered complimentary credit monitoring and identity protection services for 24 months. It has also stated that its investigation found no evidence that the disclosed information had been used fraudulently.
Williams is seeking class certification on behalf of a proposed class that the complaint alleges includes more than 1,000 individuals affected by the incident. The complaint asserts negligence and claims under California’s unfair business practices legislation, placing more than $5 million in controversy for federal jurisdictional purposes.
The allegations remain unproven, and the court has made no determination concerning the firm’s liability.
The litigation highlights the distinction between technical network security and the broader responsibility to prevent unauthorised disclosures. Social engineering attacks exploit human behaviour rather than necessarily compromising software or infrastructure, creating particular challenges for organisations handling confidential documents.
For law firms, those challenges intersect with professional obligations concerning client confidentiality and information security. The American Bar Association’s Model Rules of Professional Conduct require lawyers to exercise competence and make reasonable efforts to prevent unauthorised disclosure of information relating to client representations, although professional conduct requirements do not automatically establish civil liability.
A significant issue in the proceedings may be whether the plaintiff can demonstrate that Sheppard Mullin’s security arrangements were unreasonable and that any alleged shortcomings caused legally recognisable harm. Questions concerning concrete injury, causation and the suitability of the claims for class-wide treatment could influence the litigation’s direction.
The case also illustrates how confidential information belonging to individuals who are not direct clients can become exposed through legal work undertaken for corporate organisations.
As law firms increasingly rely on electronic communications and document-sharing systems, the proceedings may intensify scrutiny of employee training, verification procedures and safeguards governing transfers of sensitive information. The outcome could offer further guidance on how courts assess professional-services organisations’ responsibilities when social engineering incidents result in unauthorised data disclosures.