Incident · State breach notice (Massachusetts)
Tarter Krinsky & Drogin data breach: law firm servers accessed for two months in 2025
Compiled from public records. Updated 2026-11-13. By the cisonews.net Desk.
The Tarter Krinsky & Drogin data breach affected 196,645 people, according to the federal health breach portal, where Tarter Krinsky & Drogin LLP reported a hacking or IT incident as a business associate on September 15, 2026. Tarter Krinsky & Drogin (TKD), a law firm, says it became aware of suspicious activity in its environment on September 10, 2025. It found unauthorized access to some of its servers at various times between July 9 and September 9, 2025, during which information was viewed or obtained. The federal health breach list counts 196,645 people, filed by the firm as a business associate. Letters offer 12 months of Cyberscout credit monitoring.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.
Why did I get a letter from Tarter Krinsky & Drogin?
TKD is a law firm, and it reported to HHS as a business associate rather than as a health care provider. The letter fills in each reader's items and does not say which client or matter the information came from. The guide to law firm breach notices compares other firms' letters.
What happened at TKD?
TKD says it investigated with outside forensic specialists, notified federal law enforcement and reviewed the affected files to find whose information they held. It says it is not aware of any attempted or actual misuse.
| Date | What the letter and the regulators' records say |
|---|---|
| July 9 to September 9, 2025 | Unauthorized access to some servers, at various times |
| September 10, 2025 | TKD becomes aware of suspicious activity |
| June 5, 2026 | First notices: Indiana (49,406 total) and Massachusetts (963) |
| June 9, 2026 | Posted by Texas (325) |
| September 15, 2026 | Report to HHS (196,645); notice recorded by California |
The notices came in two rounds: state notices in June 2026 with an Indiana total of 49,406, and an HHS report in September 2026 counting 196,645. The documents do not say whether the second round covers people the first did not.
What information was involved?
The letter fills in each reader's items. The Texas record lists names, Social Security numbers, driver's license and other government ID numbers, financial information, medical information and health insurance information. Massachusetts marks Social Security numbers, financial accounts and driver's licenses as breached.
How many people were affected?
| Regulator | What it counts | Number |
|---|---|---|
| HHS Office for Civil Rights | Individuals affected (September 2026) | 196,645 |
| Indiana attorney general | Total affected (June 2026) | 49,406 |
| Massachusetts consumer affairs office | Massachusetts residents | 963 |
| Texas attorney general | Texans | 325 |
| Indiana attorney general | Indiana residents | 107 |
What is TKD offering?
Twelve months of single-bureau credit monitoring, a credit report and a credit score from Cyberscout, a TransUnion company, with fraud assistance.
| Item | Detail from the letter |
|---|---|
| Provider | Cyberscout (TransUnion) |
| Length | 12 months |
| Questions | 1-877-520-3879, Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern, excluding major U.S. holidays |
What the documents leave open
- How the unauthorized actor got into TKD's servers.
- Which clients' matters were involved.
- Why HHS's count is four times Indiana's total.
How this disclosure's timing compares
Tarter Krinsky & Drogin disclosed 268 days after the discovery date its notice gives. Across the 206 other state breach notices on cisonews.net that date discovery to the day, the median gap is 100 days.
Other legal & professional services incidents on cisonews.net
- Levin, Sedran & Berman, LLP, Breach notice, first disclosed November 12, 2026
- Employer Solutions Staffing Group, Breach notice, first disclosed November 12, 2026
- Baker Tilly Advisory Group, LP, Breach notice, first disclosed November 9, 2026
- Troutman Pepper Locke, Breach notice, first disclosed October 28, 2026; 63,358 affected in total (Indiana Attorney General)
- Baker & McKenzie, Breach notice, first disclosed October 27, 2026; 25,837 affected in total (Indiana Attorney General)
Sources
- 2026-09-15 · ATarter Krinsky & Drogin LLP, notice of data event filed with the California Attorney General, published September 15, 2026
- 2026-11-07 · ACalifornia Attorney General, data breach notification record, published November 7, 2026
- 2026-11-07 · AU.S. Department of Health and Human Services, Office for Civil Rights, breach portal (breaches affecting 500 or more individuals), published November 7, 2026
- 2026-11-07 · AIndiana Attorney General, data breach year-to-date report (2026), published November 7, 2026
- 2026-11-07 · AMassachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report, published November 7, 2026
- 2026-11-07 · ATexas Attorney General, data security breach reports, published November 7, 2026
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.