Gallivan, Gallivan and O'Melia dba Digital WarRoom (“DWR”) data breach

What we know

Gallivan, Gallivan and O'Melia, doing business as Digital WarRoom (“DWR”), operates within the specialized legal technology and e-discovery sector, providing litigation support, document review infrastructure, and digital forensics to law firms, corporate legal departments, and government entities. Because of the nature of its operations, DWR routinely ingests, processes, and hosts massive volumes of highly confidential, privileged, and proprietary information. This repository frequently includes confidential client records, internal corporate communications, sensitive personal identifying information (PII) belonging to litigants and employees, financial disclosures, and intellectual property. The centralization of such vast amounts of high-value data makes e-discovery and legal tech vendors exceptionally attractive targets for cybercriminals seeking to exploit intellectual property or harvest sensitive personal details for malicious use. In 2025, Gallivan, Gallivan and O'Melia dba Digital WarRoom (“DWR”) reported a significant security incident to the Massachusetts Attorney General, highlighting vulnerabilities within its digital infrastructure. While specific technical vectors vary in incidents of this scale, data breaches affecting legal technology and e-discovery providers typically involve unauthorized access to centralized document repositories, compromise of third-party vendor platforms, or sophisticated ransomware deployments. Because these platforms are designed to aggregate data from multiple complex litigation matters, a single security lapse can expose cross-client document databases, putting an entire portfolio of sensitive legal and corporate information at risk of exfiltration. The exposure of data through a legal technology provider like DWR introduces severe risks of identity theft, financial fraud, and corporate espionage. When files containing full names, Social Security numbers, dates of birth, financial account details, and confidential employment or medical records are compromised, victims face an elevated, long-term threat profile. Unlike basic consumer accounts, legal and corporate discovery datasets often contain deeply intimate biographical and financial histories used in litigation or internal investigations. Once exposed on the dark web, this information cannot be reset or easily altered, leaving affected individuals vulnerable to targeted phishing schemes, fraudulent credit applications, and unauthorized account takeovers for years to come. As a custodian of sensitive personal and corporate data, Gallivan, Gallivan and O'Melia dba Digital WarRoom (“DWR”) was legally bound by state consumer protection statutes, such as the Massachusetts Data Privacy Law, as well as implied common law duties of care, to implement and maintain robust cybersecurity safeguards. These obligations require regular risk assessments, strict access controls, data encryption both in transit and at rest, and continuous network monitoring to detect unauthorized activity. The occurrence of a data breach of this magnitude indicates a potential failure to maintain these foundational security standards, suggesting that existing safeguards were inadequate to protect against foreseeable cyber threats. For individuals who have received a data breach notification letter from Gallivan, Gallivan and O'Melia dba Digital WarRoom (“DWR”), the communication serves as a formal legal admission that their confidential data was compromised due to inadequate security practices. Legally, the receipt of this notice establishes the necessary standing to participate in a class action lawsuit aimed at holding the company accountable for its negligence. Crucially, affected class members do not need to demonstrate that they have already suffered actual financial loss or identity theft to seek legal recourse; the increased risk of future harm and the loss of privacy are sufficient grounds. Our firm is investigating this breach on a contingency fee basis, meaning there are never any out-of-pocket costs or attorney fees unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.