The law firm data breach nobody notices: share links that never die

In 2021 a fee earner shares a folder of a client's case documents with an expert witness. The setting is "anyone with the link", because the expert's firm blocks external logins. The case settles in 2022. The fee earner leaves in 2023.

The folder is still open today. Nobody has looked at it in three years, and nobody would know if somebody else had.

When people search for "law firm data breach", they usually find ransomware stories and claims firms. Those are real. But the quieter kind of exposure, the one nobody notices, is the share link that was never closed.

The law firm data breach that starts with an old link

Firms are careful at the moment of sending. They check the address, they encrypt the email, they mark it privileged. The weak point is afterwards, when the matter closes and the links stay open.

A share link set to "anyone with the link" has no expiry of its own on many platforms. Google Drive, for example, will expire a share to named people but not an open link, which we covered in Google Drive will expire a named share. "Anyone with the link" will not.

An open link isn't a breach until someone uses it, and by then you may never find out. That is what makes it different from a lost laptop.

What recent law firm breach notices actually say

Some US state attorneys general publish the breach notices that businesses send to affected people, and law firms are no exception. The recent ones are worth reading, because few of them describe a break-in. Several describe files ending up somewhere they shouldn't.

• Lexitas, a litigation support vendor that hosts deposition transcripts, told the California Attorney General on 22 October that a server configuration error had left files in its OnDemand application reachable online without a login since around September 2019. It learned of this from a customer on 29 May 2026, and says its limited server logs could not show whether any one person's information was viewed.
• Blank Rome said in its notice to the California Attorney General that on 21 May 2026 a caller posing as its IT department persuaded an attorney to upload files to an external Google Drive account. The firm says it caught this within two hours and deleted the files.
• Sheppard Mullin reported on 2 October that a single attorney was socially engineered on 31 August, which led to certain documents being disclosed to an unknown third party.
• Troutman Pepper Locke reported on 28 October that an employee targeted by a social engineering attack on 7 August mistakenly sent certain documents to an unauthorised person. A day earlier, Baker McKenzie reported that two of its users were socially engineered in August and a limited number of files were obtained. Law360 covered both notices.

Across the sector, CrowdStrike's 2026 Legal Threat Landscape Report, published on 28 October, counted 455 legal entities named on extortion groups' data leak sites, a 39% rise on the year before.

None of these notices says a share link was involved, and we're not suggesting one was. What they do show is how often the hard question after an incident is where a file went, who could open it, and for how long.

How an open share link becomes exposure

Links travel further than the people they were sent to. They get forwarded to a colleague, pasted into a chat, saved in a browser history on a shared computer, or kept in an expert's notes long after the case.

None of that needs anyone to act in bad faith. It only needs the link to keep working. And if the platform only records access to signed-in users, an open link opened by a stranger may leave little trace.

We won't put a number on how often this happens. We haven't seen a reliable figure, and inventing one wouldn't help you. What you can do is find out how many open links your firm has.

Auditing your firm's old share links

Ask whoever runs your cloud drive for a list of links shared outside the firm, and close the ones from finished matters.

That check doesn't make a firm compliant with anything, and it doesn't replace advice on your obligations. It does shrink the number of doors left open.

Make expiry the default, not the exception

Closing old links fixes the past. The habit that fixes the future is setting an expiry date every time a file leaves the firm.

With TinyX, every link can carry a password and an expiry date, on every plan, including Free. File links can also stop after a set number of downloads. When a link expires, the file is deleted rather than archived, and the link shows a "Link Unavailable" page with no redirect.

So the 2021 folder becomes a link that worked for the expert's report window and then stopped. If the expert needs it again, they ask, and you issue a new one. Your share link from 2021 still works goes into the general problem in more detail.

What TinyX records, and what it doesn't promise

Every password attempt on a TinyX link is logged, and link passwords are stored as salted hashes. You can see when a link was opened, by country, device and referrer. Access logs are kept for 7, 90 or 365 days depending on plan, so we log what we need, not nothing.

A file on a TinyX link is encrypted on the wire and on disk, but only end-to-end encryption keeps it between you and your recipient, and that comes with Pro and Max. TinyX runs on Cloudflare, a US company, without a region pin, so we don't claim UK or EU hosting.

We don't claim TinyX prevents breaches or makes a firm compliant. It makes the link stop working on the date you chose, which removes one common way old files stay reachable.

Where to start

Run a report of your firm's externally shared links this week and close everything from finished matters. For the next file that leaves the firm, use a TinyX link with a password and an expiry date on the Free plan. Our secure file sharing guide for law firms covers the day-to-day side.