DocketWise data breach: immigration law firm records cloned from partner code repositories

Why did I get a letter from DocketWise?

Because your immigration law firm used DocketWise. The letter says DocketWise received each person's information through its business relationship with their immigration law firm. Many people who get the letter will never have dealt with DocketWise themselves. The letter describes the company as an immigration and case management solution for legal professionals, in particular immigration attorneys. The guide to letters from companies you never dealt with explains this pattern. The guide to vendor breach notices compares how other service providers describe their role.

What happened at DocketWise?

In October 2025 DocketWise suspected that credentials for one of its third-party partner repositories might have been accessed. It opened an investigation with outside cybersecurity experts. The forensic work confirmed that the credentials had been used to clone several repositories. The letter does not name the partners, the repository service or how the credentials were obtained.

The company says the experts found no evidence of ongoing unauthorized activity, and it notified the FBI. A data analytics firm then reviewed the cloned data to work out whose it was and what it contained. DocketWise says it has no evidence the incident was meant to target immigration firms, or that anyone's information has been published. The guide to law firm breach notices covers incidents at the firms themselves.

Date	What happened	Source
September 1, 2025	Breach date given by Indiana and Washington	Indiana and Washington records
October 2025	DocketWise suspects partner repository credentials were accessed	Notice letter
April 3, 2026	Letter date; notice sent, per Indiana; reported to Washington	Notice letter, Indiana and Washington records
July 3, 2026	Last day to enrol in IDX monitoring	Notice letter

About six months passed between the suspicion in October 2025 and the April 3, 2026 letters. The letter puts that down to "a thorough and time-intensive review" of the data. The guide to how long organizations take to notify sets that against other letters in this log.

What information was in the DocketWise breach?

It varied by person. The letter gives each reader's name and then a placeholder, "<<variable data elements>>", where that person's own list goes. Washington's record shows what the cloned records could hold: name, Social Security number, driver's licence or Washington ID number, full date of birth, passport number and medical information. Each letter as mailed lists that person's own items.

How many people were affected by the DocketWise breach?

Indiana gives the only total: 116,708 people.

Record	People counted
Indiana attorney general, total	116,708
Washington residents	689
Indiana residents	233

The Rhode Island count in the filed sample is a placeholder. The ranking of 2026 breaches by people affected shows where the Indiana total falls, and the Washington ranking compares Washington counts.

What is DocketWise offering?

Two years of complimentary credit monitoring and identity restoration through IDX, where available. Enrolment was at app.idx.us/account-creation/protect or by phone, with the code at the top of the letter. The deadline was July 3, 2026, so the window has closed. The guide to credit-monitoring offers compares this offer with others.

Was my information in the DocketWise data breach?

If you received a letter from DocketWise dated April 3, 2026, from a P.O. box in Suwanee, Georgia, your information was in the cloned data. The assistance line is 1-844-890-7449, Monday to Friday, 9 a.m. to 9 p.m. Eastern Time, excluding U.S. holidays. Your immigration law firm can also tell you whether it used DocketWise. DocketWise's address is 3700 N. Capital of Texas Hwy, Austin, TX 78746.

What the notice leaves open

• Which partners' repositories were cloned, and on which service.
• How the valid credentials were obtained.
• Which immigration law firms' clients were involved.
• What each person lost; the sample leaves the list as a placeholder.