Law firms spend millions on cyber security, but 73% of data incidents involve no hacker at all

A US software company was locked in a bitter legal battle over its intellectual property. It claimed a widely used operating system contained stolen code and was already suing one of the world's biggest tech companies over that claim. Then, it turned its sights on corporate end-users, launching lawsuits against a national retailer and a global automaker.

Within days, a tech news site obtained a copy of the legal complaint against the automaker. But when journalists toggled on Track Changes, an unexpected story emerged.

Just two weeks prior, the targeted defendant wasn't the automaker at all. It was a major national bank. The document's metadata revealed weeks of work that had gone into building a federal copyright case against the national bank, before pivoting at the last minute to a state-level contract dispute against the car company.

In a single document, the public could see exactly who was in the firing line, which legal strategies had been abandoned, and where the lawyers had doubts.

This multi-million-dollar leak didn't come from an insider whistle blower or a sophisticated cyber-attack. It came down to a simple oversight where the document still included metadata when it was shared externally.

Document metadata

Different file types, whether it’s Word, Excel, or PowerPoint, can hold far more than the words on the page. Some of it is useful, some of it is harmless, and some of it can undo months or years of work or damage reputation.

• Document properties such as author, organisation, and creation and edit dates.
• Tracked changes and comments, which can preserve deleted wording, earlier positions and internal notes about the client or the other side.
• Hidden content, such as hidden rows and columns in a spreadsheet, hidden text, or speaker notes in a slide deck.
• Artificial redactions, where a black box covers text on screen but the text itself is still in the file.

The difficulty is that none of this shows up when the sender reviews the document before sending it. The recipient, however, is only a couple of clicks away from seeing everything.

Metadata misses can happen to the best firms

Because metadata is hidden from plain view, mishaps are surprisingly common. It is the ultimate example of "out of sight, out of mind", and it catches out even the most experienced legal teams.

Hidden rows.

During the global financial crisis, days after a major investment bank collapsed, a law firm was acting for the buyer of the bank's US business. One evening, a spreadsheet of nearly 1,000 rows listing the contracts in the deal had to be reformatted and converted to PDF for posting on the bankruptcy court's website. Some rows were hidden because those contracts were not meant to be part of the deal. When a junior associate resized the rows late that night, the hidden rows became visible and were carried into the PDF. The sale closed days later with well over a hundred contracts on the list that shouldn't have been there. By the time the error was found, the firm had to go back to the bankruptcy court and ask for relief from its final sale order.

Artificial redaction.

In a high-stakes patent battle between two global technology companies, a junior associate working late failed to fully redact the confidential terms of a licence between the opposing party and a third company from an expert report. The report was then circulated to the client's own staff, in breach of a protective order. Two years later, the court sanctioned both the client and its law firm, ordering them to pay more than $2 million between them to cover the other companies' costs of pursuing the issue.

The black boxes.

In a closely watched federal criminal case, a defendant's lawyers filed a response with several passages blacked out. The black boxes hid the text on screen, but anyone could copy the passages and paste them into another document to read them. Journalists did exactly that, revealing previously undisclosed details of the defendant's contacts with an overseas associate. The filing was removed and later replaced with a properly redacted version.

The circumstances differ, but the pattern is the same. A lawyer can perfect every word on the page and can still miss the hidden data.

Digging deeper

High-profile cases make memorable cautionary tales, but there's more. Figures from the UK Information Commissioner's Office (ICO), which publishes data on the security incidents organisations report, suggest that similar errors happen every day.

In the first quarter of 2024, 73% of all incidents reported to the ICO were classed as non-cyber, meaning they had no malicious outsider behind them. The single most common incident type was data emailed to the wrong recipient, at 18% of the total.

The legal sector is no exception. An analysis of ICO data by NetDocuments, published in February 2025, found that reported breaches in the UK legal sector rose by 39% between Q3 2023 and Q2 2024. It attributed 39% of them to human error, including failures to redact, and 37% to data being shared with the wrong person. (NetDocuments counts each type of data affected in an incident as a separate breach, so these are best read as proportions rather than incident totals.)

None of these figures measures metadata leaks specifically. What they do show is that a large share of the risk sits with ordinary documents and emails leaving the firm in an unintended state.

A duty, not a nicety

In the United States, where most of the published guidance sits, the question of who is responsible for hidden data points to the sender.

The American Bar Association's Formal Opinion 06-442 found no ethics rule that stops a lawyer from reviewing metadata in a document received from the other side. In practice, that leaves the protection of the client's information with the lawyer who sends it. A 2012 review in Virginia Lawyers Weekly found that, of roughly 16 ethics bodies that had looked at the sender's position since the mid-2000s, nearly all had found a duty of reasonable care not to expose client confidences through metadata.

The Supreme Court of Arizona's Attorney Ethics Advisory Committee put it most plainly. A lawyer sending a document outside the privileged circle is responsible for first scrubbing confidential metadata from it, and knowing how to do so is part of the duty of competence. The committee was clear that this is not a heavy burden and that the level of scrubbing depends on how sensitive the information is. Edit histories and embedded comments, especially privileged exchanges with the client, should be removed before a file is shared.

It also offered an analogy worth remembering. Using special software to dig out metadata that a sender has tried to remove is like taking a document from another lawyer's open briefcase. The briefcase owner should not have to lock it, but should not leave sensitive papers sitting on top either.

In England and Wales, the bar is arguably higher. Paragraph 6.3 of the SRA Code of Conduct for Solicitors requires solicitors to keep clients' affairs confidential unless the law requires or permits disclosure or the client consents, and paragraph 3.2 requires the service to be competent. The SRA's own guidance notes that the courts treat the duty of confidentiality as unqualified: a duty to keep information confidential, not merely to take reasonable steps to do so.

Routine checks

Every case above came down to a document going out without a critical final check. Preventing that doesn't take technical expertise, just a few good habits.

• Separate drafts from deliverables. Decide what the recipient should see, whether that is a clean copy, a redline or a document with comments, and produce that version deliberately.
• Resolve tracked changes and comments before sending externally, rather than relying on how the document happens to display on your screen.
• Check spreadsheets for hidden rows, columns and sheets before converting or sharing them.
• Use proper redaction, then test it. Drawing a black box is not redaction. Copying the redacted passage and pasting it into a blank document is a quick way to check that the text has gone.

That last point is the case for building the check into the sending process itself. Basic scrubbing features already exist in programs such as Microsoft Word and Adobe Acrobat Pro, and dedicated tools such as Draftable Clean go further, scanning attachments as an email is composed, applying different rules for internal and external recipients, and flagging PDF text that has been covered but not removed.

The tool matters less than the principle. Every document a firm sends says something about it. The question is whether it says only what was intended.