Jurisdiction
Two US law firms filed breach notifications describing ransomware incidents affecting client matter data, together covering roughly forty thousand individuals. Both notifications state that data was exfiltrated before encryption. Neither firm named the vendor or system involved. State attorneys general published the notifications in their breach registries, which is how the incidents became public.
A Southern District of New York judge imposed sanctions on two lawyers whose brief cited six cases that do not exist, referring both to the state bar and ordering them to notify their client. The court found the citations were generated by an AI research tool and filed without verification. Sanctions include a monetary penalty and mandatory continuing education. The opinion sets out a verification standard that the court says it will apply to future filings across its docket.
Corrected . An earlier version of this card said the penalty was $7,500. Reuters and Law360 report $5,000; Bloomberg Law reports $7,500. The summary now states the sanction without a figure and the key point carries both.
Read the long piece on LexRegisterA New York State Bar Association committee addressed whether entering client information into a generative AI service is a disclosure under the confidentiality rule. The opinion says it is, unless the provider is contractually barred from training on the input and from human review. Standard consumer terms do not meet that bar. Firms are advised to obtain enterprise agreements before use.