On November 10, 2026, Kneupper & Covey, PC, a consumer-protection law firm with a Georgia mailing address in Alpharetta, posted a notice saying unauthorized parties got into a reporting tool it used with its case-management system. According to the firm, they exploited a weakness in that tool to create administrator accounts and ran searches over roughly ten weeks. The firm says the information involved did not include Social Security numbers or card numbers, but it may include client case notes and billing records. If your firm or practice connects add-on tools to the system that holds your client files, this is a good week to check them.
What the firm has said
In its Notice of Data Breach, the firm says "one or more unauthorized parties gained access to a commercially available reporting tool we used with our case-management system. They exploited a weakness in that reporting tool to create administrator accounts." It says it believes the searches ran "between August 12, 2026 and October 22, 2026," and that when it discovered the activity it "took the tool offline, disabled the unauthorized accounts and began investigating our server logs." The firm adds: "We have no evidence that any information has been misused."
The notice says what was involved varies by person and "may have" included names and contact details; for clients, case information, billing records such as invoices and descriptions of the firm's work, notes and email correspondence; for a limited number of people, bank account information; and for prospective clients, information they submitted when asking about the firm's services. The firm says it did not include Social Security numbers or credit or debit card numbers. A listing on Breachrecord of the firm's filing with the Texas Attorney General shows 4,700 people affected. The firm's notice does not give a number.
What we are not claiming: The firm has not named the reporting tool or its maker, and we don't either. We are not saying the firm's case-management system itself was breached beyond what the notice describes, that any data was copied or published, or that this was ransomware; the notice mentions none of those things. The firm says information "may" have been revealed, not that it was stolen. We are not saying any other law firm or Brotherly client was affected, and we aren't giving legal advice. The examples below are the kinds of tools practices commonly connect, not known facts about this incident.
Why this matters for law firms and other professional practices
Most firms protect the main system, such as the case, practice or accounting platform, and pay less attention to the add-ons around it: reporting and dashboard tools, billing exports, document-assembly plug-ins, intake forms. Those tools often hold a copy of the data or a standing login to the main system, and they are easy to set up and forget. In this notice, the weak point was one of those add-ons, and the attackers' first move was to create their own administrator accounts. For a small firm that handles client files, billing records and trust-account details, an unnoticed account like that can sit in place for weeks. Here the firm's own timeline runs from August 12 to October 22.
What to do this week
- List every tool connected to your case, practice or accounting system. Include reporting and analytics tools, billing exports, integrations, plug-ins and anything with an API key or a stored login. Ask your IT provider to help, and note who installed each one.
- Remove what you don't use. If no one has opened a connected tool in months, disable it and revoke its access to the main system.
- Review administrator accounts. In the main system and in each connected tool, list every admin and look for accounts nobody can explain, especially ones created in the last few months. Remove any that don't belong and require MFA for every admin login.
- Update or isolate tools that face the internet. Ask each vendor whether it has security updates you haven't applied. If a tool must be reachable from outside, put it behind your VPN or a login with MFA, and keep it off a network segment that can reach everything else.
- Turn on and keep logs. Make sure the system and each add-on records admin account creation and searches, and that logs are kept for at least several months. Searches over weeks are only visible if someone saved the history.
- Know your notice duties before you need them. Ask your carrier and counsel what triggers notice to clients and regulators, and who you call first. We can't advise on the law, but we can make sure the technical facts are ready when you talk to them.
- Warn staff and clients about phishing after any incident. The firm's own notice tells clients to watch for unexpected messages claiming to be from the firm and says it will never ask for bank account information by email. A written rule that you never request account details by email is worth adopting before something happens.
The takeaway for IT decision-makers
The firm's notice describes an attacker who used a weak spot in a connected tool, made new administrator accounts, and searched for weeks before anyone noticed. The lesson for any practice is to treat connected tools as part of your security perimeter: know what's attached, remove what's unused, review who has admin rights, and keep logs long enough to look back. If you would like help mapping the tools connected to your client-file systems, Brotherly Technology can help.
Sources
- Kneupper & Covey, PC: Notice of Data Breach (posted Nov 10, 2026; checked Nov 11, 2026)
- Breachrecord: Data Breaches This Week (Nov 5 to Nov 11, 2026) (Texas AG filing listed Nov 10, 2026; 4,700 people; checked Nov 11, 2026)