Shared Admin Password Exposes Law Firm Client Data

One shared admin password at a law firm let users impersonate staff and clients, access detailed personal data, and even see health records, according to The Register Security.

That is not a password problem. It is an identity failure. If one credential can make anyone look like anyone else, the firm has already lost control of accountability, audit trails, and client confidentiality before an outside attacker ever touches the system.

A Shared Admin Password Turned Identity Into Theater

The Register’s PWNED column tells the story through “Manny,” a reader who joined a law firm “a few years ago” and effectively became its entire IT department. He found that the firm’s applications and data lived inside one large web-based interface, split by client type, including areas for personal injury cases and travel refunds.

Then came the real discovery: a master credential. With the right email address and the admin password, a user could log in as staff or clients.

“I immediately raised this as a huge security risk,” Manny told The Register. “But I was told, 'Oh that's the admin password, everyone uses it. Don't touch it.'”

The firm’s response matters as much as the weakness. Management did not treat this as a live confidentiality risk. It treated the password as a workflow feature.

That is the governance failure. A law firm can’t credibly protect privileged communications, client PII, medical information, litigation files, or financial records if broad access depends on a commonly known shared admin password.

One Credential Broke Audit Trails, Privilege, and Basic Access Control

The mechanics were blunt. If someone knew the target’s email address and the shared admin password, they could impersonate that person. Manny described practical uses inside the firm: sign in as a sick colleague to reassign work, or log in as a client to complete a missing field.

That may sound operationally convenient. It is also the exact kind of convenience that destroys attribution.

If a document changed, who changed it? If a client record was viewed, who viewed it? If medical information was accessed, was it a lawyer, a paralegal, an administrator, a contractor, or someone who had copied the password months earlier?

A shared privileged credential turns logs into weak evidence. The system may show an account action, but it cannot prove the human behind it with confidence.

For attorney-client privilege, the problem is sharper. Privilege depends on controlled confidentiality. A platform where “many people in the law firm” had a credential that could reach client data, including health records, puts that control in doubt.

The insider-risk angle is unavoidable. A disgruntled employee, curious staffer, former contractor, or anyone who learned the password could become a shadow user. No phishing kit required.

The 15-Year-Old System Was Bad. The Replacement Decision Was Worse

The platform itself was 15 years old, according to The Register’s account. Manny was asked to build a new system, and the boss wanted the same kind of back door carried forward.

Manny refused.

“I point blank refused to add any back doors to it,” Manny recalled. “So they promoted every user to a system admin and carried on, business as usual.”

That line is the whole story in miniature. The firm did not merely inherit legacy risk. It re-created the risk when given a chance to remove it.

Here is the difference between the two approaches:

This is where legal tech vendors also matter. If a product makes impersonation easy but logging weak, it nudges firms toward dangerous shortcuts. Safer systems need explicit admin actions, named accounts, clear logs, and permission boundaries that don’t collapse under pressure.

For a broader XOOMAR security-culture lens, see our related analysis, GhostExodus Forces Cybersecurity to Trust a Rule-Breaker, which also turns on what happens when institutions ignore uncomfortable technical truths.

The Legal-Sector Numbers Make the Password Choice Hard to Defend

The broader legal-security context makes this case look less like a freak anecdote and more like a warning flare.

The ABA’s 2023 Legal Technology Survey Report found that 29% of law firms reported a security breach. Breach rates rose to 41% for firms with 100-499 attorneys. Among firms with 500 or more attorneys, 60% said they did not know whether their firm had suffered a breach.

That last figure is brutal. Not knowing whether a breach happened is itself a visibility failure.

Client pressure is also visible in the same survey context. 27% of respondents had been asked by clients for the firm’s security requirements documentation. For firms with 50-99 attorneys, that figure was 59%.

A shared admin password is exactly the kind of fact a client security questionnaire is designed to expose.

ABA Model Rule 1.6(c) requires lawyers to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” A firm that knowingly allows broad impersonation through one common credential will struggle to explain how that fits modern expectations for reasonable access control.

Clients, Lawyers, and IT Staff See the Same Failure From Different Angles

Clients do not care whether the root cause is legacy software, budget pressure, or partner impatience. They care whether sensitive files could be accessed without a trustworthy record of who did it.

Lawyers may see security controls as friction. That is a cultural problem. The Register story shows why friction exists: MFA, named accounts, role-based permissions, and admin logging slow down bad shortcuts as well as ordinary workarounds.

IT staff deserve a more sympathetic read. Shared admin passwords often survive because old systems lack better tooling, emergency access becomes routine, and leadership refuses to fund change. Manny’s case is a clean example: the person who identified the risk did not have the authority to fix the governance problem.

Clients and firm leaders should ask direct questions:

• Privileged access: Are admin actions tied to named individuals?
• Impersonation: Can staff log in as clients or colleagues, and if so, is every action logged?
• MFA: Is multi-factor authentication enforced on critical systems?
• Segmentation: Are files restricted by matter, role, and client need?
• Offboarding: Are credentials revoked immediately when someone leaves?

Related reading: GhostExodus Forces Cybersecurity to Trust a Rule-Breaker is a useful companion on why security failures often persist after experts raise the alarm.

The Next Test Is Whether Shared Admin Passwords Become Indefensible

The practical fix is not exotic. Law firms should eliminate shared privileged accounts, issue named admin credentials, enforce MFA, segment access by role and matter, rotate credentials, and review logs regularly.

Clients should make this contractual, not conversational. Ask outside counsel whether privileged access is individually tracked, whether support impersonation is logged, and whether third-party security reviews are available.

The unresolved tension is management discipline. Manny spotted the risk. He refused to rebuild the back door. The firm’s leadership still chose convenience.

The evidence to watch is simple: client questionnaires, outside counsel guidelines, and legal tech admin controls. If those start explicitly banning shared privileged accounts, firms clinging to a master password will not look unlucky after an incident. They will look careless.

Impact Analysis

• A shared admin password allowed users to impersonate staff and clients, destroying accountability and audit trails.
• The flaw exposed sensitive legal, personal, financial, and health-related information to broad internal misuse.
• Management’s acceptance of the password as a workflow tool points to a deeper governance failure, not just a technical mistake.