Publications

(Article from Securities Law Alert, January 2023) 

For more information, please visit the Securities Law Alert Resource Center

On January 10, 2023, the SEC filed a request seeking a court order that would force a multinational law firm based in Washington, D.C. to reveal the names of its public company clients that were impacted by a 2020 cyberattack. Memorandum of Applicant, SEC v. Covington & Burling, No. 1:23-mc-00002 (D.D.C. 2023). The cyberattack affected 298 of the firm’s clients, although the firm has claimed that based on its review only seven of those clients had material, nonpublic information affected by the attack. The SEC is seeking to enforce its March 2022 administrative subpoena demanding the firm disclose the names of the 298 clients impacted by the attack.

The SEC is seeking the client names as part of an investigation into “whether any persons or entities involved in or impacted by the Cyberattack have been or are engaging in violations of the federal securities laws.” The SEC has explained that it seeks information from public companies victimized by cyberattacks for various reasons, including to identify potential illegal trading either based on information gathered during the attack or on the fact of the attack itself and to determine if affected companies have made all required investor disclosures concerning any material cybersecurity events.

The SEC claimed that the identity of the firm’s impacted clients is not protected by the work product doctrine, because the firm compiled the list with the business intention of reaching out to clients in the wake of the cyberattack, not in anticipation of litigation. The SEC also argued that compliance with the subpoena would not violate D.C. Rule of Professional Conduct 1.6(a)(1), which generally prevents a lawyer from revealing a client confidence or secret, because that rule is subject to Rule 1.6(e)(2)(a), which “permits the lawyer to reveal client confidences or secrets when required by law or court order.”