Commentary asks if breach counsel can be sued by affected people
Original title: The Next Target for Data Breach Lawsuits – Law Firms That Represent Breached Parties
The cited Texas class action concerns the law firm's own alleged breach, not a client's incident.
Mark Rasch's commentary considers a hypothetical in which people affected by a company breach sue the law firm hired to manage the response for delaying notice. He argues that claim differs from alleging the firm failed to secure data on its own systems, and that duty is unclear. He points to Lowry v. Linebarger Goggan Blair & Sampson, LLP, filed October 27, 2026, in the Western District of Texas, as the firm's own alleged breach and notice case, not proof of the broader theory.
Unconfirmed: The lawsuit theory is hypothetical; the article does not report a ruling adopting it.
- The hypothetical assumes the law firm itself was not hacked.
- The proposed class action is against an Austin-based firm.
- The piece says no court has recognized the consumer malpractice theory described.
- The full essay is published at Security Boulevard.
- Organizations
- Linebarger Goggan Blair & Sampson
- Countries
- United States
From the original article
3 min read at databreaches.netMark Rasch writes: Imagine a company gets hacked and hires a law firm to manage the response. The lawyers coordinate the forensic investigation, determine which notification laws apply, and advise management about what to disclose and when. Months later, the notices arrive.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.