Blog post2026-10-26By Tyson Benson

Your Law Firm May Hold Sensitive Data on People Who Never Hired You

A law firm breach affected health information tied to nearly 197,000 people. Learn what firms should verify about sensitive client-supplied data.

Get your free review Explore the Security Baseline

A law firm may represent one organization and still hold sensitive information about tens of thousands of people.

That is the striking part of the Tarter Krinsky & Drogin breach. The U.S. Department of Health and Human Services lists the firm as a HIPAA business associate in a hacking or IT incident involving a network server and 196,645 individuals. Those people were connected to the firm's healthcare clients; they were not necessarily clients of the firm themselves.

The count of open matters does not tell a firm how much personal information it holds. One healthcare, employment, insurance, or commercial matter can bring records for a large population into the firm's systems.

What the law firm disclosed

According to a notice filed with the California Attorney General, the firm detected suspicious activity on September 10, 2025. Its investigation determined that an unauthorized party accessed certain servers at various times between July 9 and September 9, 2025, and viewed or obtained information stored there.

The notice explains that the firm possessed protected health information through its representation of a healthcare provider. It says the firm completed a review of the affected files, notified federal law enforcement, implemented additional cybersecurity measures, and offered eligible recipients credit-monitoring and fraud-assistance services. As of the notice, the firm said it was unaware of identity theft or fraud resulting from the incident.

The HHS Office for Civil Rights breach portal records a September 15, 2026 submission affecting 196,645 individuals. The incident received renewed attention after an October 23 report from The HIPAA Journal.

The dates are easy to misread. The incident happened in 2025; what is new is the public disclosure of its scale.

What is confirmed—and what remains unknown

The public record supports several important facts:

An unauthorized party accessed certain law-firm servers.
Information on those servers was viewed or obtained.
The affected records included protected health information held through a client relationship.
HHS lists 196,645 affected individuals and classifies the event as a hacking or IT incident involving a network server.

The public record does not identify the initial access method. It does not establish that the attacker entered through a publicly exposed server, exploited a software vulnerability, stole a password, bypassed multifactor authentication, or deployed ransomware.

An incident report can establish that someone got in without explaining how. It would be a mistake to infer a vulnerability or a missing control from the notices alone.

Your firm's data footprint is larger than its client list

Law firms routinely receive information about people other than their clients, including:

Patients of healthcare organizations
Employees and applicants in employment matters
Customers involved in commercial disputes
Claimants and policyholders in insurance matters
Consumers involved in investigations or class actions
Witnesses, family members, and opposing parties
Individuals represented in discovery productions

One production can add thousands of names, medical records, financial details, account identifiers, or other sensitive records to a firm's environment. Copies can spread into email, document-management platforms, local downloads, shared drives, litigation-support systems, and backups.

So the more useful question is not just, “How many clients do we have?” It is:

When a law firm becomes a HIPAA business associate

Not every law firm is regulated as a HIPAA business associate. The answer depends on the services performed and whether those services involve protected health information.

HHS explains that a healthcare entity may disclose protected health information to a lawyer for qualifying legal work and that the lawyer may serve as a business associate. HHS also states that the parties must make reasonable efforts to limit protected health information to the minimum necessary for the purpose. Its guidance notes that this may include de-identifying information or removing direct identifiers when appropriate.

Firms should sort this out when they plan the engagement, not after an incident. Those serving healthcare organizations should know:

Which engagements involve protected health information
Which business associate agreements apply
What information the firm is permitted or required to receive
Which lawyers, staff members, and vendors may access it
How the information must be returned, retained, or destroyed

The same discipline helps with other sensitive client data: understand the obligations before the files arrive. Our guide to law firm cybersecurity requirements explains where HIPAA may fit.

Seven questions firm leadership should ask now

1. Which matters contain high-impact data?

Start with matters involving health records, Social Security numbers, payment information, government identifiers, credentials, biometrics, or large groups of people. The inventory need not copy sensitive records. Note the matter, data category, responsible attorney, systems used, and approximate scale.

2. Are you receiving more information than the legal work requires?

Ask whether the client can provide a narrower dataset, redact unnecessary fields, or remove direct identifiers. A full collection may not be needed at the start of a matter. Less data means fewer records to protect and sort through if something goes wrong.

3. Where do additional copies appear?

Follow a sample file from the client's transfer through its eventual return, destruction, or retention. Check email attachments, attorney downloads, shared folders, collaboration platforms, discovery tools, expert systems, archives, and backups. A well-managed document system does not help if duplicate copies remain in mailboxes or personal sync folders.

When sharing matter documents, check the recipient, link scope, permissions, and existing guest access. Our Microsoft 365 client-file sharing checklist covers those verification steps.

4. Who can access the matter today?

Check whether access is limited to the current matter team or inherited from a broad department or old permission group. Review former personnel, temporary users, outside experts, shared accounts, and old external links. Use separate identities, strong authentication, and useful logs where the platform supports them.

People need to know what to do when a request feels unusual or a file goes to the wrong place. Cybersecurity awareness training for law firms can help reinforce those steps, alongside access controls and other technical safeguards.

5. What happens when the matter ends?

Agree on who decides whether client-supplied data is returned, destroyed, or retained. Include exports, email attachments, litigation databases, and backups in that decision. Closing the matter does not automatically remove every copy.

6. Can the firm reconstruct what happened?

Ask the IT provider which systems log sign-ins, file access, downloads, and administrative changes—and how long those records are kept. If access looks unusual, the firm should be able to investigate what happened, not just confirm that the system was running.

7. Could the firm identify affected people efficiently?

Reviewing files after a breach can take time, especially when no one knows where the data went. Decide in advance who will coordinate the inventory, client communications, evidence preservation, and notification analysis.

The law firm incident response plan template can help leadership assign response roles and prepare before an incident.

What an external review can—and cannot—show

An external exposure review can identify public-facing domains, subdomains, email infrastructure, certificates, and certain internet-accessible technologies associated with a firm. It can help show what an attacker may see from outside.

It cannot tell the firm every category of client information stored internally, confirm that permissions are appropriate, or rule out a compromise. Those questions require authorized internal evidence and an understanding of the firm's matters and systems.

The Tarter Krinsky & Drogin notice does not say a publicly exposed asset caused the breach. An external review and an internal data inventory answer different questions; firms need both views.

Protect the data population behind every matter

The starting point can be simple. Firm leadership should be able to answer:

What sensitive client-supplied data do we hold?
Where is it stored and who can reach it?
What evidence shows that the safeguards are actually working?

The Law Firm Security Baseline independently reviews evidence for essential controls protecting client information, including Microsoft 365 identity and access, external sharing, devices, backups, logging, and monitoring. It is not a HIPAA compliance determination and cannot guarantee that a firm has not been compromised. It helps leadership see what is working, what needs attention, and what to verify with the firm's existing IT provider.

Sources

This article provides general cybersecurity information and does not constitute legal or compliance advice.