There is no causal link between the two events. That is precisely why they matter.
Quinn Emanuel Urquhart & Sullivan had the sort of week that gets discussed at partner retreats for years, through gritted teeth and very painful memories.
On Thursday 3 September, Reuters reported that Quinn Emanuel and McDermott Will & Schulte had both suffered data breaches, both traced to social engineering, both notified to law enforcement.
Quinn Emanuel’s incident, dated 14 August, involved what the firm described as unauthorised access to stored files in a single software application through one temporarily compromised user account.
Among the files exposed: documents relating to short seller Muddy Waters, obtained by the firm in a Florida lawsuit. McDermott told the Vermont attorney general its exposed files included Social Security numbers and health data, and characterised the incident as isolated, involving a single user and a limited number of documents.
Roughly thirty hours later, a federal court in the Western District of Texas disqualified Quinn Emanuel from representing Techtronic Industries in its defamation suit against Muddy Waters, finding the firm had obtained relevant confidential information during its earlier representation of Muddy Waters in a related government investigation.
The same firm, the same adversary and the same underlying commodity, which was other people’s secrets.
The two events are legally and factually unconnected. The breach was a criminal act by an outside party. The disqualification was a judicial finding about internal conflict management.
The commodity nobody prices
A modern global litigation firm is, functionally, a warehouse of confidential information that happens to bill by the hour. Deal documents, regulatory correspondence, investigation files, board minutes, personal data belonging to people who have never heard of the firm and never consented to it holding anything.
Firms have spent fifteen years industrialising the acquisition of that material. Lateral hiring brings in partners with client relationships and, inevitably, with knowledge. International expansion multiplies the jurisdictions in which the material sits and the regulatory regimes that govern it.
Document review platforms, matter management systems, e-discovery vendors and now generative AI tools each add a place where the material is copied, indexed and stored.
What has not scaled at anything like the same rate is governance and control over that material.
Conflict systems at most large firms remain a database query, a circulated email and a partner’s judgment about whether a prior matter is “substantially related.” The plain fact is that is not enough.
The fact is that sensitive information and its security at most large firms remains multi-factor authentication and an annual training module that partners click through while on a call.
Two different failure modes, one root cause. The firm knows more than it can track.
The disqualification is the expensive one
Cyber incidents attract the headlines because they involve criminals and Social Security numbers. But for a litigation firm, disqualification is the more directly painful event.
A breach produces notification costs, regulatory correspondence, class action defence and reputational damage.
Those are real, and increasingly common, considering that WilmerHale is defending a proposed class action in Washington DC over a May incident, and HSF Kramer, Goodwin Procter, Taft Stettinius & Hollister, Jones Day and Wiley Rein have all reported incidents this year. Law firms are now routinely on the receiving end of the advice they sell.
Disqualification is different. It removes the firm from a live, high-value matter, hands the client a fee dispute and a transition problem, and creates a written judicial finding about the firm’s ethics that opposing counsel will cite for years.
Carson Block, Muddy Waters’ founder, has already made the argument publicly: at least eight recent conflict-related disqualifications and resignations, he says, is not bad luck but a pattern.
Quinn Emanuel disputes the conflict characterisation, saying it was a single attorney briefly represented Muddy Waters on a different matter, and it denies the conflict allegations. Firms are entitled to that position, and disqualification orders are frequently contested. And obviously nothing about a disqualification finding establishes misconduct.
What it does establish is that a court, looking at the firm’s own records, reached a different conclusion about substantial relationship than the firm’s conflict process did.
What this means for firm management
Three implications for anyone running a large firm.
Lateral due diligence is now an information governance exercise, not a revenue exercise. The question is not only what book of business a partner brings, but what confidential information arrives with them, from whom, and under what undertakings. Engagement letters from prior firms containing non-use covenants do not disappear when the partner moves.
Conflict systems need to model relationships, not just names. A query that returns “no current matter” for an entity misses the substantially related prior engagement, the affiliate, the fund, the acquired subsidiary. Muddy Waters is not a large organisation. If a firm’s system can miss that, it can miss anything.
Security failure is now a client-relationship event, not an IT event. Outside counsel guidelines from sophisticated in-house teams already impose security requirements. Expect them to get sharper, to include audit rights, and to include termination triggers. A general counsel who reads that a firm’s entire document store was reachable through one compromised account will ask what else is reachable.
The uncomfortable part
Large firms sell judgment about risk as they advise on breach response, on privilege protection, on information barriers and on the management of conflicts in complex corporate structures. They are, in principle, the people best placed to get this right.
The evidence of the last fortnight suggests the profession has been better at selling the advice than at buying it.
None of this is an argument against scale, because scale is what allows a firm to run a global antitrust defence or a multi-jurisdiction restructuring at all.
But scale without appropriate governance is not competitive advantage but is instead is accumulated exposure waiting to be unleashed.
Both arrived at Quinn Emanuel’s door within about thirty hours of each other. That is not a coincidence anyone should find comforting.
