When must law firms notify clients after Google Docs hacks?

The alert never arrives with the right vocabulary. A partner forwards a client email, a vendor advisory, or a news link about a “Google Docs hack” and asks whether the firm has to tell anyone. The first answer should not be yes or no. Under ABA Formal Opinion 483, the client-notification duty turns on what the firm knows or reasonably suspects about client confidential information: actual or suspected unauthorized access, disclosure, or loss of material client information, or a significant impairment of the firm’s ability to perform the engagement. A headline about Google is not the trigger; the trigger is the effect on the client’s information or representation.[1][2]

That distinction matters because “Google Docs hack” is usually a sloppy label. It may mean dumped Gmail credentials, a malicious OAuth grant, a publicly reachable Drive link, a compromised Workspace account, a third-party integration token, or an attacker using Google Drive as storage after taking data from somewhere else. “Google was not breached” may be true and still not answer the ethics question. A firm can have a client-notification problem without a breach of Google’s infrastructure.

Classify the Google-related event before answering the client question

On an incident call, the useful sequence is not “Was this in the news?” or “Did Google send a statement?” It is: whose account, what access, what client material, what matter, how long, and whether the firm can still do the work. The same Google label can sit on both sides of ABA 483’s line.

The table is not a substitute for counsel’s judgment, but it stops the most common mistake: treating all Google-adjacent events as if they answer the same ethics question.

Credential dumps: alarming, but not automatically client-notice events

Credential dumps are the easiest Google-related event to overstate. In October 2025, Troy Hunt analyzed the Synthient threat-data set: 183 million unique email addresses in about 3.5 TB of data, with roughly 91% already seen in Have I Been Pwned and 16.4 million new addresses. Google said its systems were not breached.[3] A separate early-2026 report associated with Fowler described an unsecured database of about 149 million credentials, including about 48 million Gmail credentials.[4]

Those numbers justify urgency, not automatic client notice. A partner’s personal Gmail address in an infostealer collection does not, by itself, establish that a firm Workspace account was accessed, that Google Docs were opened, or that client files were disclosed. It does require the firm to ask whether that credential was reused, whether the user had firm-system access, whether any successful logins followed, and whether the account contained or could reach current-client confidential information.

That is still an ethics issue. ABA Law Technology Today’s 2026 guidance warned that even compromised personal Gmail credentials can feed credential-stuffing against firm systems, implicating Model Rule 1.6’s reasonable-efforts obligation.[5] The client-notification question and the reasonable-security question are related, but they are not the same. A firm may have work to do under Rule 1.6 before it has enough facts to notify a client under ABA 483.

OAuth abuse is closer to access than a password list

OAuth incidents deserve a different tone because the user may have handed an application permission to read or act inside an account. The 2017 Google Docs phishing worm used fake Google Docs invitations and OAuth authorization to spread, affecting more than 1 million users.[6] That was not the same fact pattern as a static credential dump. The central question becomes what permission the malicious app received and whether it used that permission against material client information.

If an associate clicked a malicious Google Docs invitation but logs show no access beyond contact harvesting, the notice analysis may remain unresolved or narrow. If the OAuth grant allowed mailbox reading and the mailbox held negotiation drafts, diligence reports, or litigation strategy for a current matter, “no confirmed exfiltration” may not be enough to close the file. ABA 483 asks what is actually known or reasonably suspected, not what the attacker was theoretically capable of doing in the abstract.

The 2025 Salesloft Drift incident shows why third-party tokens should not be dismissed as someone else’s breach. Google’s Threat Intelligence Group reported that threat actors used compromised Salesloft Drift OAuth tokens in a campaign involving data theft from Salesforce instances; Google also confirmed access to email from a very small number of Google Workspace accounts on August 9, 2025, revoked tokens, disabled the integration, and notified impacted Workspace administrators.[7] For a law firm that received such an administrator notice, the useful question is not whether Google’s core systems were breached. It is whether the affected Workspace account or integration could reach client confidential information and whether logs support actual or reasonably suspected access.

Attackers also do not need a single dramatic download to create a notice problem. Huntress has described Google Workspace persistence techniques involving inbox rules, forwarding rules, calendar abuse, and OAuth grants.[8] Those mechanics matter because they change the time window. A mailbox rule that silently forwarded matter correspondence for weeks creates a different notice record than a one-time suspicious login blocked by multifactor authentication.

Open Drive links turn on exposure, contents, and jurisdiction

Drive misconfiguration sits in an uncomfortable middle. The Ateam incident, reported in 2025, involved 1,369 files exposed through Google Drive links affecting 935,779 individuals, with exposure dating back to March 2017 and no evidence of theft reported.[9] For a law firm, “no evidence of theft” is helpful, but it does not end the analysis if the exposed files contain current-client confidential information.

Under ABA 483, the firm still has to decide whether material client confidential information was actually or reasonably suspected to have been accessed, disclosed, or lost. A public or broadly shared Drive link may support a reasonable-suspicion finding even when the firm cannot prove a particular outsider downloaded a particular file. The harder the file was to discover, the shorter the exposure, and the better the access logs, the stronger the case for continued investigation rather than immediate client notice. The more sensitive the material and the weaker the logging, the less persuasive a simple “we have no evidence” script becomes.

The March 2026 homoglyph campaign impersonating “Alston & Bird” shows a different Drive problem. IronScales reported a Google Drive-sharing phishing message using a lookalike law-firm name where SPF, DKIM, and DMARC passed because Google sent the notification.[10] That kind of alert can fool a busy lawyer precisely because it arrives through a trusted channel. It is still not automatically a client-notification event for the impersonated firm or the recipient firm. The notice question turns on whether anyone authenticated, granted access, uploaded client material, or otherwise exposed current-client information in response.

When Google Drive is the staging area for law-firm exfiltration

The cleanest notification analysis is often the most unpleasant one. In the January–May 2026 UNC3753 campaign described by Mandiant and Google Threat Intelligence Group, attackers targeted U.S. law firms; in one reported sequence, they exfiltrated 1.7 GB from a law-firm target’s OneDrive into a Google Drive account before pivoting through virtual desktop infrastructure. The GTIG report relayed the FBI’s IC3 Flash Cyber Alert 260526 in describing the campaign.[11]

That is not a “Google Docs breach” in the loose headline sense. It is a law-firm exfiltration event in which Google Drive appears as attacker infrastructure. For the affected firm, the ABA 483 question is unlikely to stay theoretical. The firm has to map the 1.7 GB to clients, matters, document types, and current representations. It also has to decide whether the client’s identity is itself confidential and whether disclosing the incident to one client risks revealing another client’s confidential information.

This is where a risk or knowledge-management lawyer usually becomes unpopular on the call. “We do not yet know which clients” is not the same as “no clients.” “The files were in OneDrive, not Google Docs” is not the same as “the Google Drive reference is irrelevant.” The vector matters because it tells the firm where to collect facts; it does not excuse the firm from the current-client notice analysis once exfiltration is reasonably suspected.

What ABA 483 notice is supposed to accomplish

ABA 483 does not require a theatrical confession. It requires enough information for the current client to make informed decisions about the representation. Business Law Today’s discussion of the opinion describes the notice-content minimums as including the fact of the breach, the information reasonably known about the breach, the extent to which client material was accessed or disclosed, and the firm’s plan to respond.[2]

That standard punishes both extremes. A vague “out of an abundance of caution” notice that hides the affected matter may not let the client protect itself. A premature notice that suggests client files were stolen when the only fact is a stale Gmail password in a criminal dump can create unnecessary harm and confusion. The hard work is not drafting the notice; it is reaching the point where the firm can say what happened, what is unknown, and what the client needs to decide now.

This is also why the firm should separate current clients, former clients, and prospective clients early. ABA 483’s current-client duty is the central ethics trigger discussed here. Former-client duties, contractual notice provisions, protective orders, insurance obligations, and state data-breach statutes may point elsewhere. They should not be collapsed into a single “Google hack notice” answer.

State ethics opinions can lower the comfort level

ABA 483 is a strong starting point, not a universal safe harbor. The most dangerous advice in this area is the confident statement that no client notice is required because the firm cannot prove access. Several state and local ethics analyses make that answer less secure.

New York City Bar Formal Opinion 2024-3 is especially important because it largely adopts ABA 483’s incident analysis while changing the result in a material way. It concludes that when a cybersecurity incident involves information obtained in a current client matter, the lawyer must notify the client regardless of whether the information is material to the representation. It also flags a conflict problem: Rule 1.7 may prevent the firm from advising the client about claims the client may have against the firm arising from the incident.[12]

That is a very different conversation with a partner. Under the ABA framing, the debate may focus on materiality and reasonable suspicion of access. Under the NYC Bar approach, if information from a current matter was obtained in the incident, the firm should not assume immateriality avoids notice. And if the client asks, “Do we have a claim against you?” the firm may need independent counsel rather than a self-serving reassurance.

Other state opinions push in different ways. New York State Bar Opinion 842, a cloud-specific opinion from 2010, frames the lawyer’s duty around investigation and notification when cloud-stored client confidential information is compromised. Maine Opinion 220 is the warning label for open-link and misconfiguration cases because it treats mere exposure of client confidential information as potentially requiring disclosure. Michigan RI-381 uses a material-breach concept and calls for timely notice. The differences are not academic when the facts are a publicly reachable Drive folder, an OAuth token with broad scopes, or logs too thin to prove what happened.

The same state-opinion discipline appears in other vendor incidents, including the analysis in What the Claude Breach Demands From Law Firms. The vendor changes; the ethics move does not. Identify the information, the matter, the client status, and the governing jurisdiction before declaring the notification question closed.

Civil consequences make delay a separate risk

Ethics opinions are not the only consequence channel. In Hiscox Insurance Co. v. Warden Grier LLP, decided in the Western District of Missouri on July 23, 2020, claims based on breach of contract and implied contract survived dismissal after an alleged 16-month delay in notifying insurer clients of a law-firm data breach; the claims were tied to litigation-management guidelines.[2] The case does not rewrite ABA 483, but it shows why notice delay can become its own allegation when a client can point to contractual or course-of-dealing expectations.

Johnson & Bell and SEC v. Covington & Burling sit in the same consequence background. They are not Google Docs cases, and they do not supply the ethics trigger. They do illustrate that law-firm security incidents can become disputes about class standing, client identity, confidentiality, and who gets to demand information about affected clients. That matters in Google Drive exfiltration and open-link cases because the notice project may itself require care not to disclose one client’s confidential information while informing another.

There is also no single state data-breach statute answer to graft onto a Google Docs incident. Statutes vary by covered data elements, acquisition or access triggers, timing rules, regulator notice, consumer notice, and exceptions. They may run alongside the ethics analysis, but they should not be used to shrink it. A firm that wants the statutory-clock problem in more detail can compare the state-patchwork discussion in 5G core session hijacking and carrier breach clocks; the point here is narrower. Ethics notice to a current client is not identical to statutory notice to an individual consumer.

The decision boundary

A law firm does not notify clients merely because a Google Docs, Gmail, or Workspace headline exists. It also should not hide behind the phrase “Google was not breached” when the firm’s own account, token, Drive link, or client file may have been exposed.

The defensible sequence is narrower. First, classify the event: credential dump, OAuth grant, open Drive link, Workspace-token compromise, account compromise, or law-firm exfiltration using Google infrastructure. Second, determine whether material client confidential information was actually or reasonably suspected to be accessed, disclosed, lost, or made unavailable in a way that significantly impaired the engagement. Third, check the governing state or local ethics opinion before relying on ABA 483’s materiality screen.

That is the line worth briefing before the partner call. A “Google Docs hack” headline starts the inquiry. The vector and the jurisdiction decide whether clients must be told.

References

1. Formal Opinion 483 Lawyers’ Obligations After an Electronic Data Breach or Cyberattack, American Bar Association, 2018.
2. Must Law Firms Notify Clients of Data Breaches?, Business Law Today, November 2020.
3. Inside the Synthient Threat Data, Troy Hunt.
4. Gmail Data Breach Timeline, Security.org.
5. Recent Gmail Password Compromise Should Be Wake Up Call, ABA Law Technology Today, 2026.
6. Google Docs Phishing Scam a Game Changer, Dark Reading.
7. Data Theft from Salesforce Instances via Salesloft Drift, Google Cloud Threat Intelligence Group.
8. Identity Breach: Google Workspace, Huntress.
9. Android game devs Google Drive misconfig highlights cloud security risks, BleepingComputer.
10. Homoglyph Law Firm Google Drive Reply-To Domain Phishing, IronScales.
11. Targeted Campaign Against U.S. Law Firms, Mandiant / Google Threat Intelligence Group.
12. Formal Opinion 2024-3: Ethical Obligations Relating to a Cybersecurity Incident, New York City Bar Association, 2024.