A South Carolina resident has voluntarily dropped a proposed class action lawsuit against the Columbia-based law firm Riley Pope & Laney LLC (RPL), following a major data breach that compromised personal information belonging to thousands of individuals. The dismissal marks the latest development in a growing series of cybersecurity incidents involving law firms across the United States—an industry increasingly targeted by hackers due to the vast amounts of confidential data these firms manage.
Background: The Breach and Its Fallout
The incident dates back to August 2024, when Riley Pope & Laney detected unauthorized access to its network between August 11 and August 12. During this brief but damaging breach, an unknown actor infiltrated the firm’s computer systems, exposing sensitive personal data belonging to an estimated 7,000 individuals.
What made the breach particularly alarming was that some of the affected individuals were not RPL clients and had no known connection to the firm. This raised troubling questions about how their personal information—such as names, Social Security numbers, addresses, and potentially financial or health-related data—ended up stored on the firm’s servers.
In February 2025, RPL began issuing data breach notification letters to those affected, approximately six months after the incident occurred. The notification delay became a central issue in the lawsuit that soon followed, as the affected parties argued that the firm failed to act promptly to protect them from identity theft and financial harm.
The Lawsuit: Negligence and Delayed Notification Allegations
The lawsuit, filed by Jason Warren on behalf of himself and other affected individuals, accused Riley Pope & Laney of failing to implement sufficient cybersecurity measures to safeguard personal data. Warren also alleged that the firm’s delay in notifying victims of the breach—roughly half a year after discovering the unauthorized access—constituted negligence and a violation of consumer protection laws.
According to the complaint, the firm’s inadequate response placed consumers at increased risk of identity theft, fraud, and financial losses. The suit sought class action status to represent all individuals whose information was compromised during the breach, arguing that the law firm owed a duty of care not only to clients but to anyone whose data it stored.
Warren’s legal team maintained that RPL’s failure to promptly disclose the breach prevented victims from taking timely action to safeguard their information, such as freezing credit reports or enrolling in fraud monitoring. The case drew attention from cybersecurity and legal experts, many of whom noted that data breaches involving law firms can have far-reaching consequences—not only for clients but also for unrelated third parties.
Voluntary Dismissal and Mediation Efforts
After months of litigation, both parties agreed to pause the proceedings in August 2025 to engage in mediation, signaling potential settlement discussions. However, by October 22, 2025, Warren filed a notice of voluntary dismissal in the U.S. District Court for the District of South Carolina, effectively ending the class action.
While the dismissal was voluntary, neither the plaintiff nor RPL publicly disclosed the terms or reasons behind the withdrawal. Legal observers speculate that the parties may have reached a confidential resolution during mediation, though no settlement has been formally confirmed.
Importantly, the dismissal of the lawsuit does not necessarily mean the underlying security issues have been resolved or that affected individuals have been fully compensated. Instead, it marks the conclusion of this particular litigation while leaving open the possibility of future actions or regulatory scrutiny.
Wider Implications for Law Firm Cybersecurity
The case underscores the growing cybersecurity challenges facing law firms nationwide. As repositories of sensitive client data—ranging from personal identification information to trade secrets—law firms have become prime targets for cyberattacks. A single breach can jeopardize not only client confidentiality but also the firm’s reputation and financial stability.
Experts warn that many law firms, especially small to mid-sized practices, may lack the dedicated IT infrastructure or resources to defend against increasingly sophisticated cyber threats. Moreover, firms often handle sensitive data belonging to third parties, such as opposing parties, witnesses, or corporate employees, without fully disclosing such data storage practices.
Legal professionals stress that these firms must adopt stronger cybersecurity protocols, conduct regular system audits, and provide prompt notifications when breaches occur. Delays in disclosure can lead to heightened liability and loss of trust—both from clients and the public.
What Affected Individuals Should Do
For those potentially impacted by the Riley Pope & Laney breach, cybersecurity experts recommend taking immediate protective measures:
- Review breach notifications carefully – Confirm whether your personal data was compromised and understand what categories of information were involved.
- Enroll in credit monitoring – The firm reportedly offered 12 months of free credit monitoring to affected individuals. Taking advantage of this service can help detect unusual activity early.
- Check financial and credit reports regularly – Monitor for unauthorized charges or new accounts opened in your name.
- Consider a fraud alert or credit freeze – Contact major credit bureaus to restrict access to your credit file.
- Be alert for phishing scams – Cybercriminals may exploit breach information to impersonate legitimate organizations.
Looking Ahead
Although the class action against Riley Pope & Laney has been withdrawn, the incident adds to the growing list of law firm data breaches prompting legal action and increased regulatory oversight. It serves as a stark reminder that legal institutions—like any other custodians of personal data—must prioritize cybersecurity not only as a matter of compliance but also as a core ethical obligation.
Consumers, meanwhile, should remain vigilant and proactive in protecting their digital identities. As cyberattacks become more common and data breaches more costly, both individuals and organizations must take responsibility for maintaining robust data-protection practices.
Are you passionate about law, data privacy, and protecting client information? Stay ahead of emerging cybersecurity and legal trends impacting law firms nationwide. Whether you’re an attorney, paralegal, or law student looking to grow your career in this evolving area, explore thousands of exclusive legal jobs and internships on LawCrossing.com.
