Herrman and Herrman PLLC data breach investigation

Investigation notes

Herrman and Herrman PLLC operates as a professional legal services firm, navigating complex personal injury, mass torts, and civil litigation matters on behalf of individuals facing vulnerable life circumstances. Because of the nature of legal representation, the firm routinely collects, stores, and processes deeply sensitive documentation from clients, opposing counsel, expert witnesses, and medical providers. This repository of trust includes comprehensive client intake questionnaires, detailed financial records, highly confidential health and medical history, accident reports, settlement negotiations, and government-issued identification numbers. Maintaining this vast trove of private information is essential for building compelling legal claims and advocating effectively in court, yet it simultaneously creates an immense target for malicious cyber actors seeking to exploit confidential client data. In 2025, Herrman and Herrman PLLC reported a significant cybersecurity incident to the Nebraska Attorney General, raising serious concerns regarding the security posture of digital networks utilized by legal practices. Incidents affecting law firms frequently stem from unauthorized network intrusions, targeted phishing campaigns aimed at compromising administrative credentials, or vulnerabilities within third-party document management and cloud-sharing vendors. Because legal organizations act as central hubs for sensitive information across multiple industries—including healthcare providers, insurance companies, and financial institutions—a single breach of their systems can compromise an immense web of sensitive data spanning years of active and archived litigation. The exposure of client data in a law firm breach carries profound risks that extend far beyond ordinary identity theft. Compromised records frequently include full names, Social Security numbers, dates of birth, confidential medical documentation, and bank account or settlement disbursement details. When Social Security numbers and personal identifiers are leaked alongside details of ongoing legal disputes or financial settlements, victims face severe exposure to targeted financial fraud, tax return impersonation, and fraudulent credit applications. Furthermore, the exposure of private medical histories and intimate personal details creates severe privacy violations and emotional distress, leaving clients vulnerable to sophisticated extortion schemes or secondary phishing attacks that leverage the context of their active legal proceedings. As a professional fiduciary handling highly confidential client materials, Herrman and Herrman PLLC was bound by strict professional ethical duties, common law negligence standards, and state data protection statutes, such as the Nebraska Financial Data Security Act and broader consumer protection laws. These legal frameworks mandate the implementation of robust administrative, physical, and technical safeguards—including multi-factor authentication, robust encryption, continuous network monitoring, and regular security audits. The occurrence of a data breach strongly suggests potential failures in these foundational security duties, indicating that the firm may have failed to properly isolate or encrypt sensitive files, thereby exposing clients to preventable downstream harms. Receiving an official data breach notification letter from Herrman and Herrman PLLC serves as formal legal confirmation that your confidential information was compromised due to inadequate data security practices. Under established consumer privacy law, the receipt of this notice establishes the legal standing necessary to participate in a class action lawsuit seeking accountability, restitution, and enhanced monitoring protections. You do not need to prove that you have already suffered actual financial loss or fraudulent charges to take legal action; the increased, imminent risk of future identity theft is legally sufficient. Our class action law firm evaluates these cases on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.