Briefly
Live preview · United States

Legal and Regulatory intelligence for you

Legal News
United States
Legal News

CrowdStrike: AI Cyberattacks on Law Firms Double, Threatening Legal Sector

Researchers warned on October 30, 2026, that law firms and other legal entities globally are experiencing a significant increase in cyberattacks leveraging agentic artificial intelligence, with such attacks doubling since 2023, according to cybersecurity company CrowdStrike's 2026 Legal Threat Landscape Report. The report, released on Wednesday (presumably October 28, 2026), indicates a 39% increase in legal entities named as hacking targets between August 2025 and August 2026, totaling 455. CrowdStrike's Senior Vice President for Counter Adversary Operations, Adam Meyers, noted the "democratization of hacking" through agentic technology, predicting the situation will worsen before improving. While CrowdStrike did not name specific victims, Reuters reported breaches at Quinn Emanuel Urquhart & Sullivan, Wilmer Cutler Pickering Hale and Dorr, and Seyfarth Shaw in recent months. This trend poses a critical threat to client confidentiality, data integrity, and the operational continuity of legal practices, making it highly significant for practitioners. Law firms, by their nature, handle highly sensitive and valuable information, including privileged communications and proprietary business data, making them prime targets for sophisticated adversaries. The increasing use of AI in these attacks suggests a more advanced and rapidly evolving threat landscape, requiring enhanced and proactive defensive strategies. Breaches can lead to severe reputational damage, significant regulatory fines under various data protection regimes, and substantial professional liability claims, impacting both the firm and individual attorneys. The legal profession operates under strict ethical obligations regarding client confidentiality, such as those outlined in ABA Model Rule 1.6, which mandates competence in technology and reasonable efforts to prevent unauthorized access to client information. Furthermore, various data privacy regulations, including the GDPR, CCPA, and numerous state-specific breach notification laws, impose significant compliance burdens and potential penalties for data breaches. The increasing sophistication of AI-driven attacks necessitates a re-evaluation of existing cybersecurity frameworks, compliance measures, and professional responsibility standards within law firms, pushing the boundaries of what constitutes "reasonable efforts" in data protection. Key parties involved in highlighting this issue include cybersecurity company CrowdStrike, which published the 2026 Legal Threat Landscape Report, and its SVP Adam Meyers. The ABA Journal and Reuters are the sources reporting on these developments, with Reuters specifically naming law firms like Quinn Emanuel Urquhart & Sullivan, Wilmer Cutler Pickering Hale and Dorr, and Seyfarth Shaw as having experienced cyber breaches. The broader legal community, including all law firms and legal departments, are the primary stakeholders and potential targets of these evolving threats. Attorneys and legal professionals must prioritize robust cybersecurity measures, including advanced threat detection systems, regular employee training on AI-driven phishing and social engineering tactics, and comprehensive incident response planning. Firms should regularly audit their systems, consider specialized legal tech cybersecurity solutions, and stay abreast of evolving AI-powered threats and defensive strategies. Proactive risk management, continuous investment in cybersecurity infrastructure, and strict compliance with data protection regulations are paramount to mitigate the severe financial, reputational, and ethical consequences of a data breach in this increasingly hostile digital environment.

30 Oct
United States
Case Law

US Judge Approves Flo App $56 Million Privacy Settlement

A federal judge in San Francisco indicated on Thursday that he would grant final approval to a $56 million settlement in a class-action lawsuit accusing period tracking app Flo Health of improperly sharing users’ sensitive personal and health data with third parties. This development carries significant legal implications for technology companies, particularly those handling sensitive user data, by reinforcing the substantial financial and reputational consequences of privacy breaches and non-compliance with data protection regulations. The judge's public criticism of the requested attorney fees, despite indicating approval of the overall settlement, signals a growing judicial trend towards scrutinizing the fairness and reasonableness of legal fees in large class-action settlements, ensuring that class members receive adequate compensation. It also highlights the ongoing challenges in balancing attorney compensation with consumer recovery in such cases. The lawsuit involved allegations of improper sharing of personally identifiable information and private health data, likely implicating various federal and state privacy laws. While the excerpt does not specify all statutes, it mentions a related jury finding that Meta violated the California Invasion of Privacy Act (CIPA). Such cases often involve claims under state consumer protection laws, and potentially federal statutes like the Electronic Communications Privacy Act (ECPA). The proceedings are taking place in a U.S. District Court, with U.S. District Judge James Donato overseeing the settlement approval process, which requires both preliminary and final judicial review to ensure fairness to the class. The key parties in this matter include the class of app users as plaintiffs, and defendants Flo Health, Google, and Flurry. AppsFlyer was initially a defendant but claims against it were dismissed. Meta (formerly Facebook) was involved in a related jury trial concerning similar allegations. U.S. District Judge James Donato is the presiding judicial officer responsible for approving the settlement terms. Practitioners advising technology companies, especially those in health tech or any sector handling sensitive personal data, must prioritize the development and implementation of robust data privacy policies and practices. Legal counsel should guide clients on navigating the complex and evolving landscape of data privacy regulations, emphasizing transparency in data handling and strict adherence to stated privacy policies to mitigate the risk of costly class-action litigation. Furthermore, attorneys involved in class-action settlements should be prepared to thoroughly justify their fee requests to the court, as judicial scrutiny of these amounts is intensifying to ensure equitable distribution to class members.

29 Oct
United States
Case Law

GM: $220M Driver Data Privacy Settlement Ends Smart Driver Program Lawsuit

to an individual's constitutional rights, specifically the 14th Amendment. It reinforces the principle that egregious actions, such as driving under the influence in an official capacity and then attempting to obstruct justice, fall outside the protections typically afforded to officers acting within their discretionary duties. For the public, it signals that accountability mechanisms exist even for those in positions of power. The legal context for this ruling revolves around the doctrine of qualified immunity, which protects government officials from liability in civil lawsuits unless their conduct violates clearly established statutory or constitutional rights, and a reasonable officer would have known of the violation. Here, the federal court found that a reasonable officer would have understood that such reckless and deceptive behavior could constitute deliberate indifference to the motorist's 14th Amendment rights, thereby stripping the officer of this protection. The case likely proceeds under 42 U.S.C. § 1983, the primary federal statute for civil rights claims against state actors. The key parties involved are the unnamed Mississippi policeman, the motorist who was struck, and the federal court that issued the ruling. While the specific court is not named, it is typically a U.S. District Court that makes initial determinations on qualified immunity. The outcome of the underlying claims against the officer is not yet reported, as the denial of qualified immunity merely allows the lawsuit to proceed. Practitioners should take note that this case provides a strong precedent for challenging qualified immunity where an officer's actions are not merely negligent but demonstrate a conscious disregard for public safety and constitutional rights, particularly when coupled with alleged attempts to manipulate the investigation. Attorneys representing plaintiffs in civil rights cases should analyze similar facts for evidence of

29 Oct
United States
Case Law

Texas AG Ken Paxton Sues OpenAI ChatGPT Over Misleading Safety Claims

On Friday, Texas Attorney General Ken Paxton filed a lawsuit in Collin County District Court against OpenAI and its CEO, Sam Altman, alleging that the company misled Texas consumers about ChatGPT’s safety, reliability, and trustworthiness, particularly concerning teenage users, and failed to implement sufficient safeguards. This lawsuit represents a significant legal challenge to the rapidly evolving artificial intelligence industry, particularly concerning consumer protection and product safety. It signals a growing trend of state attorneys general scrutinizing AI products for potential harms, especially to vulnerable populations like teenagers. The outcome could set precedents for how AI companies are regulated regarding transparency, safety features, and consumer disclosures, potentially influencing product design, marketing strategies, and the broader legal landscape for emerging technologies. The lawsuit centers on the Texas Deceptive Trade Practices Act, a powerful statute designed to protect consumers from false, misleading, or deceptive business practices. The Attorney General's office claims OpenAI released ChatGPT products without adequate parental controls, age verification, or safety testing, and without ensuring their reliability. The complaint highlights concerns about the AI's design encouraging use and then “betraying” vulnerable adolescents, citing instances where individuals who committed violent acts allegedly consulted ChatGPT. This case operates within the broader legal landscape of consumer protection, product liability, and emerging technology regulation, pushing the boundaries of how existing laws apply to novel AI capabilities. The outcome of this matter is not yet reported. Key parties involved include Texas Attorney General Ken Paxton, who initiated the lawsuit, and OpenAI and its founder, Sam Altman, as the defendants. The lawsuit was filed in Collin County District Court in Texas, with Jonathan Stone, chief of the Consumer Protection Division of Paxton’s office, detailing the allegations in the 67-page complaint. Attorneys advising AI companies, technology firms, and consumer product manufacturers must pay close attention to this case. It underscores the critical need for robust safety testing, clear and accurate consumer disclosures, and the implementation of age-appropriate safeguards for AI products, especially those accessible to minors. Companies should proactively review their product development, marketing, and terms of service to ensure compliance with state consumer protection laws and to mitigate risks associated with alleged deceptive practices or product harms. This case also signals a potential increase in regulatory scrutiny and litigation in the AI space, necessitating a proactive and cautious approach to product development and deployment.

23 Oct
United States
Case Law

U.S. Court: Google AI Customer Service Call Recording Lawsuit Dismissed

On Thursday, a federal judge in San Francisco dismissed claims from three plaintiffs alleging Google illegally recorded customer service calls to train its artificial intelligence, while sending three other plaintiffs to arbitration in a purported class action. U.S. District Judge Rita F. Lin granted the three plaintiffs whose claims were dismissed the opportunity to amend their complaint. The case centers on allegations that companies, including Home Depot and Discover, use Google Cloud Customer Center AI as a virtual agent, and Google continues to listen to calls, even when transferred to a human, and uses recordings for AI model training without explicit notification to callers about Google's involvement. Specifically, two plaintiffs, James Fox and Peter Samish, had their California Invasion of Privacy Act (CIPA) claims dismissed because they failed to sufficiently allege a lack of consent, as they were Home Depot accountholders who had agreed to privacy policies disclosing Google's access to calls. This ruling carries significant implications for companies developing and deploying AI-powered customer service solutions, particularly those involving call recording and the utilization of data for AI training. It underscores the critical importance of having clear, comprehensive, and easily accessible privacy policies and terms of service that explicitly address data collection, storage, and usage, especially when third-party vendors like Google are involved in processing customer interactions. For consumers, the decision highlights the legal weight of agreeing to privacy policies and the potential for such agreements to impact their ability to pursue certain privacy claims. The legal context of this case is rooted in the California Invasion of Privacy Act (CIPA), a statute designed to protect individuals from unauthorized recording of communications. Judge Lin's decision largely hinged on the concept of consent, finding that the accountholder plaintiffs had plausibly consented to Google's access through their agreement to Home Depot's privacy policy, which incorporated such disclosures. This emphasizes the legal enforceability and significance of user agreements and privacy disclosures in the context of digital services and extensive data collection. The procedural distinction between dismissal with leave to amend and compelling arbitration also illustrates different avenues for resolving claims in complex class action litigation. The key parties involved are Google, the defendant, three unnamed plaintiffs whose claims were dismissed with leave to amend, James Fox and Peter Samish, two specific plaintiffs whose CIPA claims were dismissed, and three other unnamed plaintiffs who were compelled to arbitration. Home Depot and Discover are mentioned as companies utilizing Google's AI service. U.S. District Judge Rita F. Lin is the presiding judge. The Courthouse News Service is the source of this report. Businesses utilizing AI for customer service, especially those involving call recording and data processing by third-party vendors, must meticulously review and update their privacy policies and terms of service to ensure explicit disclosure of all data practices, including the involvement of third parties and the use of data for AI training. Attorneys advising such companies should prioritize obtaining clear, informed, and unambiguous consent from users. For plaintiffs' attorneys, this ruling indicates a high bar for alleging lack of consent when comprehensive privacy policies are in place, necessitating careful pleading to demonstrate that consent was either not given or that the scope of consent was exceeded.

23 Oct