Correction, 23 October 2026: An earlier version of this article said the firm waited about a year before notifying anyone, counting 359 days from discovery to a September 2026 notice. State attorney general filings show notifications began on 5 June 2026, 268 days after discovery, with a further round in September 2026 after the file review was completed. The notification timeline, the description of whose patients were affected, and the data-types section below have been corrected, and a comparison with another law-firm case has been removed.
New York law firm Tarter Krinsky & Drogin LLP has reported a data breach involving the protected health information (PHI) of 196,645 patients, after attackers accessed its servers between July and September 2025. The Tarter Krinsky data breach is notable for two reasons: the files included confidential and attorney-client privileged information, not only patient health data, and notification came in two waves: the first on 5 June 2026, 268 days after discovery, and a further round in September 2026 after the file review was completed.
The patients were never the firm’s clients. The PHI belonged to patients of the firm’s healthcare clients, plural, as reported in the firm’s filing with the US Department of Health and Human Services (HHS). The clients have not been named.
What happened in the Tarter Krinsky data breach
Attackers accessed certain Tarter Krinsky & Drogin servers at various times between 9 July 2025 and 9 September 2025, and information stored on those servers was viewed or obtained, according to the firm’s notice filed with the California Attorney General. The firm became aware of suspicious activity in its environment on 10 September 2025 and launched an investigation with third-party forensic specialists.
The HIPAA Journal reports the breach also involved confidential and attorney-client privileged information, the sharpest angle in a law-firm breach, since the firm held client confidences, not just patient records.
The figure of 196,645 individuals comes from the firm’s report to HHS. The HIPAA Journal headlined its 23 October 2026 story “197,000 Individuals”; the exact 196,645 figure is in the body of its report. SecurityWeek on 20 October 2026 reported “more than 196,000 individuals”; Tarter Krinsky was covered in a section of SecurityWeek’s Paradigm Healthcare report, not as a standalone article. Notification came in two waves: state attorney general filings show the first notices went out on 5 June 2026, and the firm’s California notice is dated 4 September 2026, after the file review was completed. The HIPAA Journal reports that notification letters are now being mailed following completion of that review.
Read also: our data breach tracker, which lists the other confirmed incidents we cover. The other incidents on that page are unrelated to this breach.
Why the notification timeline is the story
The access window ran 63 days, from 9 July to 9 September 2025. Discovery came the next day, 10 September 2025. The first notifications went out on 5 June 2026 (268 days after discovery, about nine months) according to state attorney general filings, including a notice to the New Hampshire Attorney General dated 5 June 2026 and filings in Massachusetts, Vermont and Maine. A second round followed in September 2026, once the file review was completed; the California notice is dated 4 September 2026. The delay is now the core of a proposed class action filed in New York federal court, In re Tarter Krinsky & Drogin LLP Data Privacy Incident, case 1:26-cv-05667 (SDNY), which alleges the firm maintained “intentional opacity” about the breach. That is an allegation in a complaint, not a court finding, and it should be read that way. The day counts in this section are our reconstruction from the dated documents above, not figures the firm published.
Long notification gaps matter because exposed health data does not expire. A patient whose records were viewed in 2025 faces the same phishing and identity-theft risk in 2026 as on the day of the breach, and 268 days without a warning is 268 days in which they could not watch for misuse tied to it.
Whose data was it
The PHI belonged to patients of the firm’s healthcare clients, not to the firm’s general client base. The HIPAA Journal, reporting the firm’s HHS filing, puts it as “196,645 patients of its healthcare clients”. The clients are not named in any source, and this article does not name any. Law360’s 23 September 2026 summary used the singular: “an unnamed healthcare provider” — for one recipient’s letter; the aggregate HHS figure covers the firm’s healthcare clients, plural.
That shape, a law firm holding patient records for healthcare clients, is the third-party pattern behind many large breaches: the organisation that loses the data is not the organisation the patient ever dealt with.
What is confirmed, and what is not
Confirmed: the firm, the 196,645 figure via its HHS report, the July to September 2025 access window, discovery on 10 September 2025, first notifications on 5 June 2026, a further notification round in September 2026, and the data types below. The firm also stated it was unaware of any identity theft or fraud occurring as a result of the event. That is the firm’s statement, not an established fact that no misuse occurred.
The data types involved, as listed by The HIPAA Journal from the firm’s report, varied by individual and may include some or all of the following: name, Social Security number, driver’s licence number, date of birth, international tax identification number, passport number, tax identification number / individual tax identification number, financial account information, payment card information, username and password, medical information, health insurance information, and biometric data.
Not confirmed: no attacker identity, no ransomware-group claim, no attack method, and no statement on whether data was exfiltrated or only viewed appears in any source reporting this breach.
What to watch next
Four things will move this story. First, whether the proposed class action (case 1:26-cv-05667, SDNY) advances past the complaint stage, and whether a court tests the “opacity” allegation. Second, whether the firm names which healthcare clients’ patients were affected, which would let patients know with certainty whether their records were involved. Third, whether any confirmed misuse tied to this breach emerges, which would change the firm’s “unaware of misuse” position. Fourth, whether regulators ask why the first notification took 268 days after discovery in the Tarter Krinsky data breach.
What to do if you may be affected
If you received a notice, or you were a patient of a provider that uses outside law firms, five steps are worth taking. Change passwords first: usernames and passwords were among the exposed data, so change the password on any account that shared the exposed password, and change reused passwords anywhere else you used them. Watch for phishing messages that reference medical care, since health details make fake messages more convincing. Consider a credit freeze, which blocks new accounts from being opened in your name; our guide explains how: How to Freeze Your Credit Reports. Review health insurance statements for care you did not receive, and keep the breach notice itself, since class actions and any future remedy will ask for it.
Sources
- Tarter Krinsky & Drogin Notice of Data Event, California Attorney General, dated 4 September 2026: oag.ca.gov
- Notice to the New Hampshire Attorney General, dated 5 June 2026 (filing copy): classactionu.org
- SecurityWeek, 20 October 2026: Tarter Krinsky covered in a section of the Paradigm Healthcare report: securityweek.com
- The HIPAA Journal, 23 October 2026: hipaajournal.com/data-breach-new-york-law-firm/
- Law360, 23 and 25 September 2026 (summaries via Law360 listings); proposed class action In re Tarter Krinsky & Drogin LLP Data Privacy Incident, case 1:26-cv-05667 (SDNY)
