Rodenburg Law Firm data breach: debt recovery files with Social Security numbers and medical details

Why did I get a letter from Rodenburg Law Firm?

The letter's first line gives the firm's business: Rodenburg Law Firm is a debt recovery law firm. It does not say how the firm came to hold each reader's information, or on whose behalf. Texas published its report on April 24, 2026, three days after the letter date. A reader who has never hired the firm may still be in its files. The guide to letters from companies you never dealt with explains how that happens with firms that hold data for someone else.

What happened at Rodenburg Law Firm?

After it found the activity, the firm says it opened an investigation, brought in cybersecurity experts and notified law enforcement. The investigation found unauthorized access to the network by an unknown third party for a short span of time. The firm says the incident was limited to its own network. Certain files in that environment were exposed to the intruder.

The letter does not say how the intruder got in, what "a short span of time" was in hours or days, or whether files were copied or only exposed. It does not mention ransomware or name any group. A review of the exposed data concluded on March 20, 2026, and the firm says that is when it learned whose information was involved.

Date	What happened	Source
August 26, 2025	Rodenburg discovers anomalous activity; breach date in California's and Indiana's records	Letter; California and Indiana records
March 20, 2026	Review of the impacted data concludes	Letter
April 21, 2026	Letter date; notice sent, per Indiana	Letter; Indiana record
April 24, 2026	Texas publishes the report	Texas record

The letter is dated 238 days after the discovery and 32 days after the review ended. California's record gives August 26, 2025 as the date of the breach. The guide to how long companies take to notify compares that gap with other California filings in this log.

What information was in the Rodenburg Law Firm breach?

The filed sample names the data in full, with no blank field for it. It lists first and last name, in combination with Social Security number, date of birth, payment card number and medical condition or treatment information.

Texas's record lists four categories: name, Social Security number, financial information such as account or card numbers, and date of birth. The Texas form does not list medical information for this report, though the letter does. The two documents are set side by side here and not reconciled.

Data type	In the letter	In the Texas record
Name	Yes	Yes
Social Security number	Yes	Yes
Date of birth	Yes	Yes
Payment card number	Yes	Financial information
Medical condition or treatment	Yes	Not listed

Because the list includes medical details, the letter's reference guide advises reading statements from health care providers and insurers as well as banks.

How many people were affected by the Rodenburg Law Firm breach?

Indiana gives the only total: 119,895 people.

Record	People counted
Indiana attorney general, total	119,895
Texas residents	606
Indiana residents	231

The ranking of 2026 breaches by people affected shows where it falls, and the ranking of breaches affecting Texans compares the Texas count.

What is Rodenburg Law Firm offering?

Twelve months of single-bureau credit monitoring, credit report and credit score services from Cyberscout, a TransUnion company, at no charge, with fraud assistance. Enrolment was at bfs.cyberscout.com/activate with the code printed on each letter, within 90 days of the letter date. Counting from April 21, 2026, that window closed in July 2026. The guide to credit-monitoring offers compares this offer with others in this log.

The offer is single-bureau monitoring, so it watches one credit file, not all three. The letter's reference guide adds that a credit freeze is free and must be placed separately at each credit bureau.

Was my information in the Rodenburg Law Firm data breach?

If you received a letter from Rodenburg Law Firm dated April 21, 2026, from a Cyberscout P.O. box in Dearborn, Michigan, your information was in the exposed files. The letter gave 1-833-289-5011 and incident@jrllawoffice.com for questions, staffed for 90 days from the letter date, 8:00 a.m. to 8:00 p.m. EST, Monday to Friday. That window has also passed.

The guide to law firm breach notices covers how other firms in this log describe their incidents.

What the notice leaves open

• How the unknown third party got into the network, and for how long.
• Whether files were copied, or only exposed.
• On whose behalf the firm held each reader's information.
• Why the Texas record leaves out the medical information the letter lists.