A massive Wells Fargo customer data breach was notthe work of a hacker, but of the bank's own lawyer who failed toreview the bank's entire set of discovery documents, includinginformation about the bank's wealthy customers, before it wasshipped to a litigation adversary.

The event highlights the increasing risks of relying onunfamiliar e-discovery technology — and the potential liabilityexposure to lawyers.

"Unbeknownst to me, the view I was using to conduct the reviewhas a set limit of documents that it showed at one time," saidWells Fargo's attorney, Angela Turiano, a New York-based principalat Bressler, Amery & Ross, in an affidavit. "I thought I wasreviewing a complete set, when in fact, I only reviewed the firstthousand documents."

Turiano's affirmation explains in detail how sheinadvertently provided Wells Fargo customer information, includingpersonally identifiable information about wealthy customers andtheir assets, in discovery.

The information was turned over without confidentialityprotection or redaction, appearing to violate various privacyprotection laws, Financial Industry Regulatory Authority guidanceand Securities and Exchange Commission regulations, according toopposing counsel in court documents.

Turiano blames her court adversary for revealing the informationto The New York Times, which published a report on the error.The newspaper said it was shown large portions of data thatincluded what appeared to be client names and assets undermanagement.

The escalating incident underlines the high-stakes ofe-discovery, now common to commercial litigation.

"E-discovery is a minefield," said Howard Elman, a lawyer whofrequently defends large firms in malpractice cases, adding thechance of wrongly producing documents increases with each gigabyte."It also increases the lawyer's potential exposure to liability, ifthey [lawyers] don't make sure there are sufficient safeguards inplace."

Potential damages from malpractice claims arising frome-discovery errors could include the amount of legal fees needed toremedy any data releases, regulatory actions and, if the data wasreleased to the public, potential claims by the public.

"Errors through e-discovery are becoming more pronounced becausethe volume of document production is multiplying every year," saidElman, a partner at Matalon Shweky Elman.

'Slew of Documents'

The discovery error arose in litigation involving two brothers,Gary and Steven Sinderbrand, who have served as Wells Fargofinancial advisors. Gary Sinderbrand brought a defamation suit inNew Jersey state court against his brother.

Gary and his company, Mill Lane Management, also sued hisbrother and Wells Fargo in New York state court over a breach ofconsulting and settlement agreements.

In the New Jersey action, he sought third-party discovery fromWells Fargo, including emails between Steven and the bank.

Wells Fargo retained the Bressler Amery firm to help with thesubpoena request, Turiano said in court documents. "I am the lawyerin charge of this matter," she wrote.

The bank agreed to conduct a search of four custodians' emailaccounts using designated search terms, using an outsidee-discovery service to conduct the searches.

Turiano said using the vendor's e-discovery software, shereviewed "what I thought was the complete search results" andmarked some documents as privileged and confidential. She thencoordinated with the vendor to withhold from production anythingshe tagged as privileged and confidential.

"What I did not realize was that there were documents that I hadnot reviewed," she said, adding she was using "a view" that showeda set limit of documents at one time. "I thus inadvertentlyprovided documents that had not been reviewed by me forconfidentiality and privilege."

Turiano also said the documents she flagged as needingredactions "were not redacted" before production. "I realize nowthat I misunderstood the role of the vendor," she said. "Finally, Inow understand that I may have miscoded some documents during myreview."

Gary Sinderbrand's attorney in New York, Aaron Zeisler ofZeisler PLLC, informed Turiano about the disclosure last week.

"Your firm produced a slew of documents revealing billions ofdollars of client account information, from residents of numerousstates and possibly Europe," he said in a letter to Turiano that isnow a court exhibit.

Turiano's firm has scrambled since then to have the documentsreturned.

Manhattan Supreme Court Justice Charles Ramos onTuesday signed an order restraining the plaintiffs fromany further review or use of the confidential documents, pending aAug. 10 hearing.

And on Wednesday, a New Jersey court required GarySinderbrand and his lawyers to delete any digital file copiesthey made from the information disclosed in the subpoena, and togive the court the encrypted CD and any copies, Reuters reported.The court will "safeguard the CD" until a court hearing.

Zeisler said in a July 22 letter to Ramos that Sinderbrand andhis lawyers in the New York case had not refused to return thedocuments. "Neither I nor anyone at this firm ever stated that wewould not return documents containing sensitive financial andpersonally identifying information at the appropriate time,"Zeisler wrote.

Zeisler declined to comment. Turiano did not return messagesseeking comment.

In a statement, a Wells Fargo spokeswoman said, "The security ofour clients' accounts and information is a priority at Wells Fargoand we are dedicated to protecting our client data."

The spokeswoman said the court rulings "are a positive result ofour ongoing efforts to make things right" and "we'll continue tothoroughly investigate this matter."