Have you ever received an email from someone asking you to send a document, confirm some information, or help resolve an urgent problem? Maybe the person claims to be a customer, a coworker, or someone from another department.

The request sounds legitimate, and you recognize the name. So, you send the information without giving it much thought. After all, you’re just trying to help someone do their job!

Unfortunately, that ordinary interaction could expose confidential information if the person making the request isn’t who they claim to be. A recent incident involving a major law firm shows how serious the consequences can be.

What Happened at Sheppard Mullin?

On August 31, 2026, an attorney at Sheppard Mullin, a large international law firm, became the victim of a sophisticated social engineering attack. According to the firm’s official data breach notification, the incident involved disclosing sensiive documents to an unknown third party.

The firm discovered the incident on September 1 and began investigating. Although Sheppard Mullin reported that the attacker never gained unauthorized access to the firm’s computer systems or network, instead the incident involved a single attorney who was deceived into disclosing information.

Unfortunately, some of that data contained sensitive, personally identifiable information (PII).

The firm’s breach notifications identified affected individuals, and subsequent reporting revealed that a former employee had filed a proposed class-action lawsuit alleging inadequate security safeguards.

The incident highlights an important point about cyber-compliance: Sensitive information can be exposed even when hackers never break into a company’s computer systems.

What Is Social Engineering?

Social engineering is when someone manipulates another person into revealing information, providing access, or taking an action that they normally wouldn’t take.

Instead of breaking through a technical security system, the attacker tries to trick a person. For example, someone might impersonate your supervisor and ask you to email a confidential report. Another person might claim to be from your IT department and request your login credentials.

Sometimes, attackers create a sense of urgency by claiming there’s an emergency that requires your immediate attention.

The goal is to convince you to act before you’ve had time to verify the request. Unfortunately, even experienced professionals can fall for these tricks. Many data breaches involve social engineering at some point in the process.

Mistake #1: Trusting Someone Because They Know Your Name

Imagine receiving an email from someone who knows your name, job title, and the company you work for. They even mention a project you’re currently handling.

Sounds legitimate, right? Not necessarily.

Much of that information may be publicly available through company websites, social media, or professional networking platforms. Criminals can aggregate those details very quickly with the help of AI, and that knowledge makes their fraudulent requests much more convincing.

Before sharing confidential information, verify that the person is authorized to receive it. Don’t rely solely on how familiar their message sounds!

Mistake #2: Sharing Information Without Verifying the Request

Suppose someone claiming to be a customer asks you to send a copy of their account records. They provide the correct name and account number associated with a real client. So should you send the documents?

No! Not until you’ve followed your organization’s identity verification procedures.

Knowing a few personal details doesn’t automatically prove someone’s identity. If the request involves sensitive information, always use an approved verification method before releasing anything.

For example, you might contact the customer using the phone number already listed in your company’s records rather than a number supplied in the suspicious message. A few extra moments of verification can prevent a much larger problem!

Mistake #3: Assuming Security Software Will Catch Everything

Most workplaces use security tools to help identify suspicious emails, block malicious websites, and prevent unauthorized access.

Those protections are very important. Unfortunately, they can’t prevent every situation in which an employee is convinced to share information voluntarily.

In the Sheppard Mullin incident, the firm reported that its network and systems weren’t compromised. That distinction matters.

An organization can have technical security protections in place and still experience a data exposure when a hacker manipulates an insider into disclosing sensitive documents. This is why following information-sharing policies is just as important as using secure technology!

What Should You Do If Something Seems Suspicious?

Fortunately, you don’t have to be a cybersecurity expert to recognize when a request deserves extra attention.

Before sharing confidential information:

• Verify the person’s identity. Use an approved contact method rather than relying on the information in the request.
• Question unusual requests. Be cautious when someone asks for sensitive information unexpectedly.
• Don’t let urgency pressure you. A supposed emergency shouldn’t override company security procedures.
• Check what you’re sharing. Make sure the recipient is authorized and the documents don’t contain unnecessary sensitive information.
• Report suspicious activity. Contact your IT or security team if something doesn’t seem right.

Most importantly, if you realize you’ve already shared information with the wrong person, then report it immediately. Don’t wait to see whether anything bad happens. Your organization may need to investigate the disclosure, protect affected individuals, and meet legal notification requirements.

Conclusion

The Sheppard Mullin incident reminds us that cyber-compliance isn’t just about protecting computer systems, but also taking better care of the information we handle every day.

After all, criminals don’t always need sophisticated hacking tools to access sensitive records. Sometimes, they simply need to convince someone to send those records voluntarily.

On the bright side, we can reduce that risk by paying closer attention to unexpected requests and following our organization’s verification procedures.

Before sending confidential information, always make sure the person requesting it is authentic and authorized to receive it. When it comes to protecting sensitive information, taking a moment to verify a request can make all the difference.