A former employee has filed suit against Sheppard, Mullin, Richter & Hampton over a cyberattack that exposed sensitive personal data, according to a report by the ABA Journal.

The litigation puts the large U.S. law firm in the growing category of professional-services organizations facing legal claims after threat actors accessed employee and client information. The suit, filed by an ex-employee, alleges that Sheppard Mullin failed to adequately protect personal information stored on its systems, which was compromised in the cyberattack.

What does the complaint allege?

The plaintiff claims the breach exposed sensitive personal data belonging to current and former employees. The complaint frames the incident as a failure of the firm's data-security obligations.

Law firms have become high-value targets for ransomware groups because they hold privileged client information, trade secrets, and employee records in a single environment. Breaches at legal practices routinely trigger:

• Class-action claims from affected employees and clients
• Regulatory scrutiny over notification timelines
• Contractual and reputational exposure tied to privileged client data

Why does this matter for enterprise CIOs?

The case is part of a broader pattern: organizations that suffer a breach increasingly face direct litigation from their own workforce, not only from customers or regulators. Courts continue to weigh whether plaintiffs whose data was exposed — but not yet demonstrably misused — have standing to sue, and outcomes vary by jurisdiction.

For security and IT leaders, the takeaway is procedural. Employee personal data held in HR systems, payroll platforms, and benefits administration tools carries litigation risk comparable to customer data. Vendor-managed systems warrant the same scrutiny as internal ones.

Security teams responding to incidents should coordinate legal review early, since notification decisions and forensic findings frequently become evidence in subsequent suits.

What comes next?

The lawsuit is at an early stage. Sheppard Mullin has not publicly detailed the scope of the attack, the number of individuals affected, or the ransomware group involved, and the firm's response to the complaint will determine whether the case proceeds toward class certification or settlement.

CIO Monitor will track the docket and report on filings, settlement figures, and any regulatory follow-on as they emerge.