Clark Hill PLC, a law firm, has filed a data breach notice with the Massachusetts Attorney General. This page explains what the notice says, what it leaves out and what steps people can take.
Law firms hold sensitive records on behalf of their clients, and they have a responsibility to protect that information.
Clark Hill’s Data Breach Investigation
Clark Hill PLC filed a sample notice letter with the Massachusetts Attorney General’s data breach notification list. The letter explains that Clark Hill is a law firm that provides or has provided legal services to an organization with which the recipient has a current or prior relationship. In other words, people who receive this letter may never have dealt with the firm directly. Their information may have reached the firm because of an organization it represents.
The letter says a data security incident may have affected the recipient’s name, passport number, date of birth, place of birth, nationality and gender. That combination is notable because passport details and the biographical data attached to them are the kind of information used in immigration, travel and identity verification. The letter says there is no evidence the information was misused.
The filed copy of the notice does not describe what happened. It does not say when the incident took place, when the firm discovered it, how the information was reached or when letters were mailed. It also does not say how many people received a notice. No total has been published in the filing, and this page does not estimate one.
The one step the letter describes taking since the incident is retraining employees on the importance of protecting sensitive information. The letter also says the firm has taken steps to help prevent a similar incident from happening again, without saying what those steps are beyond training.
Clark Hill is offering 24 months of complimentary credit monitoring and identity theft protection through IDX. Recipients are told to enroll using the activation code printed on their own letter, and the letter says they must enroll within 90 days of the date of the letter. The enrollment requires an internet connection and an email account and may not be available to people under 18.
The letter also sets out Massachusetts-specific rights. It tells recipients they can obtain any police report filed about the incident, and that they can place a free security freeze on their credit reports with Equifax, Experian and TransUnion. A freeze stops a credit bureau from releasing a credit report without written authorization, which makes it harder for someone to open credit in another person’s name, although it may delay approval of new loans or other services.
Passport numbers deserve particular attention. Unlike a credit card, a passport number cannot be quickly cancelled and replaced, and the combination of name, date of birth, place of birth and nationality is enough for a criminal to try to impersonate someone in applications or in messages that appear to come from an official source. People who get a notice should be careful with unexpected calls or emails that mention the incident.
Federal and state laws require organizations to safeguard personal information and to notify people when it may have been exposed. Attorneys reviewing incidents like this one look at how the information was protected, how promptly people were notified, and whether affected people may have legal options. This page relies only on the filed notice and may be updated as more information becomes available.
When Did This Breach Occur?
The filed copy of the notice does not say when the incident occurred, when Clark Hill discovered it or when letters were mailed. Those dates are not publicly available at this time. The letter’s enrollment window runs for 90 days from the date of the letter.
What Information Was Breached?
The notice says the incident may have affected the recipient’s name, passport number, date of birth, place of birth, nationality and gender. The letter does not list any other types of information. If you receive a notice, check it for the types of information named in your case.
What You Can Do
If you received a notice related to Clark Hill or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24 months of IDX credit monitoring and identity theft protection the firm is offering, using the code on your letter and within 90 days of the date of the letter.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Clark Hill
If you received a notice from Clark Hill, or you believe your personal information was exposed in this incident, you may have legal options. Whether you can seek compensation depends on the facts, and an attorney can explain whether you may be able to join a class action lawsuit over the exposure of your personal information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
