A former Sheppard Mullin Richter & Hampton LLP paralegal has launched a proposed class action against the law firm, alleging a cyberattack exposed the sensitive personal information of at least 1,000 people.

The Sheppard Mullin Data Breach Lawsuit was filed Wednesday in federal court in California by Pena-Emilia Williams, who claims the firm failed to adequately protect the personally identifiable information of employees, clients and others affected by the breach.

Williams describes the theft as a “bell that cannot be unrung,” arguing that information once exposed to cybercriminals cannot simply be pulled back behind a locked door.

“Before this data breach, [Sheppard's] employees' and clients' employees' private information was exactly that — private. Not anymore,” Williams says in the lawsuit. “Now, their private information is forever exposed and unsecure.”

Cyberattack Targeted Sheppard Mullin Attorney

Sheppard Mullin disclosed the cyberattack to the California Office of the Attorney General on Oct. 2.

According to the firm's report, a single attorney was targeted in a social engineering attack Aug. 31. The incident resulted in some documents being provided to an unidentified third party.

Williams' complaint alleges the consequences went beyond the initial disclosure. The stolen information allegedly included names and Social Security numbers, as well as driver's license and government identification numbers.

The lawsuit claims the firm failed to properly train employees in cybersecurity and did not maintain adequate safeguards and security protocols that could have prevented the attack.

Plaintiff Says Breach Response Was Also Deficient

Williams also challenges how Sheppard Mullin handled the aftermath.

The complaint alleges affected individuals were not notified by letter within the period required under California law, adding another layer to the dispute over the firm's response.

“In short, defendant's failures placed the class's PII in a vulnerable position — rendering them easy targets for cybercriminals,” Williams says.

Sheppard Mullin has said it took steps to strengthen its security practices following the incident. But Williams argues that such “simple declarations” do not guarantee that her information, or anyone else's exposed data, will remain secure.

She says she has already experienced identity theft and fraud following the breach. Williams also claims her bank issued urgent security alerts warning that her account may have been compromised and instructed her to reset access.

Former Paralegal Says She Was Directly Affected

Williams worked at Sheppard Mullin as a real estate-focused paralegal from 2022 until March 2026, according to her LinkedIn profile.

Her lawsuit seeks to represent other individuals whose information was allegedly compromised in the incident.

The case adds another legal headache to a law firm industry already facing mounting scrutiny over cybersecurity. Law firms routinely hold a vast vault of confidential material, making a successful cyberattack potentially capable of exposing information belonging to clients, employees and business partners at once.

Sheppard Mullin Joins Growing List of Law Firms Facing Lawsuits

The latest lawsuit makes Sheppard Mullin one of several major law firms to face litigation over data security incidents this year.

WilmerHale was sued in July in Washington, D.C., federal court in a proposed class action filed by a former client over an accidental disclosure of client data.

Fox Rothschild LLP was sued in June in Pennsylvania federal court following a separate data breach tied to a ransomware group.

Together, the cases underscore the growing legal pressure facing firms as cyberattacks continue to collide with the enormous volumes of sensitive information held by the legal industry.

Representatives for Williams and Sheppard Mullin did not respond Thursday to requests for comment.

Williams is represented by Andrew Gunem and Carly Roman of Strauss Borrelli PLLC. Counsel information for Sheppard Mullin was not immediately available Thursday.