Scott Lashway

Practice Areas

Scott is a globally recognized privacy and cybersecurity disputes attorney who focuses his practice on the intersections of law, corporate data, and technology. A go-to advisor for significant disputes, corporate crises, and investigations, he also serves as Co-chair of Mintz’s Privacy & Cybersecurity Practice. Along with guiding clients through high-stakes incident response and breach investigations, complex and bet-the-company litigation, government investigations, and enforcement actions, he frequently provides strategic counsel on data management and technology development and use, including development and use of artificial intelligence. Scott represents clients in a range of industries, with a particular emphasis on health care, financial services, technology, artificial intelligence, and the media and adtech sectors.

Experience

Led a team representing an academic medical center throughout its response to and investigation of a widely reported cybersecurity matter, including advising on and managing the forensic investigation, crisis communications, litigation defense, regulatory interactions, law enforcement engagement, and all related matters.

Served as lead counsel for a leading children's hospital, successfully defending allegations in a purported class action that alleged patient data was inappropriately accessed in violation of privacy and security disclosures. The case centered on a novel legal theory that a HIPAA Privacy Notice formed a contractual basis to bring actual and implied breaches of contract, a theory the court summarily rejected after significant oral argument.

Serving as lead counsel for a global financial institution and asset manager in breach of contract and fraud litigation that involved more than 10 consolidated actions over a sizable asset.

Represented a global data and technology company throughout an investigation of, and its response to, simultaneous intrusions by multiple nation-state attackers and various financially motivated threat actors.

Secured dismissal of a purported class action for a surgical and medical facility in an issue of first impression in the US Court of Appeals for the Eleventh Circuit. The case concerned Article III standing requirements to plead harm in a case brought against a health care facility, which alleged that patient data had been accessed, stolen, and posted on the internet by a well-known threat actor.