Mason Law Office Legal
Small Business Risk: High (Compliance Violation & Fines, Brand/ Reputation Damage)
Exploit: Apparent Credential- based, account take-over exploit
Risk to Individuals: High: Sensitive PII and Legal Information loss and/ or deletion
What you need to know: It’s not 100% clear that this was an insider threat-based exploit. Regardless, Mason Law Office suffered an all-too-common account-based takeover compromise. Legal firms leveraging 3rd party case management systems should take the time to review their security controls and procedure. They should also conduct a full audit to determine who has access to what data within these 3rd party systems and make the required corrections.
Mason Law Office – Sacramento, CA (mycase.com)
Date Occurred/Discovered: 5/5/18
Date Disclosed: 5/14/18
Data Compromised Client data was potentially accessed, client case information was deleted, and other administrative changes were made to the system. Generally, any information uploaded to mycase.com was potentially accessed, and information has been deleted. Information potentially accessed includes client names, social security numbers, driver’s license numbers, phone numbers, email addresses, as well as legally privileged/protected information, including legal documents, case notes, disclosures, financial statements, evidence, photos, invoices, transcripts, trust balances, and attorney-client communications.
How it was Compromised: The firm discovered evidence of unauthorized access to mycase.com by an unknown individual or group of individuals. It is unclear how this access was made.
Customers Impacted: Clients of Mason Law Firm using mycase.com.
Attribution/Vulnerability: Unknown/undisclosed at this time. https://www.databreaches.net/mason-law-office-notifies-clients-of-hack-involving-mycase-com