The HIPAA Journal reported on Oct. 23, 2026 that Manhattan law firm Tarter Krinsky & Drogin LLP has reported a breach of the protected health information of 196,645 patients of its healthcare clients. The firm's own notice, dated Sept. 4, 2026 and posted as a sample with the California Attorney General, is the source for what the firm itself has confirmed.
TKD's notice says it is a law firm assisting clients with legal services, that those clients include healthcare providers, and that through that representation it "was in possession of certain protected health information." The HIPAA Journal also reports that confidential and attorney-client privileged information was involved. Neither source describes ransomware, encryption, or an outage.
What the firm has confirmed, and what it hasn't
Confirmed in TKD's Sept. 4, 2026 notice:
- When: "On September 10, 2025, TKD became aware of suspicious activity within its environment." An investigation with third-party forensic specialists "determined that there was unauthorized access to certain TKD servers at various times between July 9, 2025 and September 9, 2025, and that certain information stored within those servers was viewed or obtained by the unauthorized actor during that time period."
- Notice timing: After a "comprehensive review of the affected files," the firm said that review "has recently been completed" and that it is notifying people whose information was in those files. The California sample is dated Sept. 4, 2026 — about a year after the last confirmed access.
- Misuse: TKD says it is "unaware of any identity theft or fraud occurring as a result of this event" and "is not aware of any attempted or actual misuse" of the information.
- Response: The firm "promptly notified federal law enforcement," is reviewing security policies, "implemented additional cybersecurity measures," and is offering twelve months of single-bureau credit monitoring and fraud assistance through Cyberscout.
Reported by the HIPAA Journal (Oct. 23, 2026): the 196,645-patient figure; that confidential and attorney-client privileged information was involved; and that the types of data varied by person and may include name, Social Security number, driver's license number, date of birth, international tax identification number, passport number, tax identification number or ITIN, financial account information, payment card information, username and password, medical information, health insurance information, and biometric data.
Not confirmed: How the unauthorized party got in, whether a phishing email or reused password was involved, which healthcare-provider clients' files were on those servers, or whether any systems were encrypted. TKD's notice and the HIPAA Journal coverage we reviewed do not describe ransomware, a downtime event, or a ransom payment. Do not infer those from silence. The California Attorney General listing records the breach dates as Sept. 9 and Sept. 10, 2025; the firm's letter describes access across the July 9–September 9, 2025 window and discovery on September 10.
Why it matters to law firms
A law firm that defends a hospital, handles a medical-malpractice file, or reviews billing disputes is often holding the same records a clinic would: charts, bills, identifiers, and privileged notes about a patient's case. Under HIPAA, that firm is generally a business associate of its healthcare client. The files still have to be guarded, logged, and reported if someone gets into them, even though the firm's day job is legal work, not clinical care.
Small and mid-sized firms feel this the same way. Matter shares, expert portals, and "just this once" email attachments collect medical and financial exhibits over years. If those stores sit on the same login as ordinary office email, one compromised account can reach privileged files and client PHI together. The other risk is slower: TKD's notice went out about a year after the last access, because identifying whose information was in the files took a long review. Firms that cannot say which matters live on which servers inherit that delay.
Clear takeaway
Treat every matter folder that holds medical or financial exhibits as a records system, not as ordinary office files. Put MFA on the places those files live, keep them off shared inboxes, know which healthcare clients you hold PHI for, and make sure you could tell a client within days — not a year — whose information was in a server that was accessed.
Actions to take this week
- Inventory where client PHI actually lives. Ask litigators, the records clerk, and your IT provider which matters hold medical records, billing files, or identifiers: document systems, email, expert shares, deposition portals, and backup copies. Write down the healthcare clients those files belong to.
- MFA on every path to those files. That includes each attorney mailbox, the document system, VPN or remote desktop, and any expert or co-counsel portal. Prefer an authenticator app or security key over text codes.
- Stop leaving exhibits in email. Move medical records and financial statements into the matter workspace, then delete the attachments from inboxes on a set schedule. Less mail sitting around means a smaller review if an account is ever compromised.
- Separate matter stores from ordinary office logins. Client file servers should not be reachable with the same password as a marketing mailbox. Named accounts, least privilege, and a log of who opened a file beat a shared "files" folder.
- Tighten vendor and expert access. Court reporters, e-discovery hosts, copy services, and experts each get their own login with MFA, turned on only for the job. Ask how long they keep your files after a matter closes — the same lesson as the Lexitas notice last week.
- Know your notice path. For every healthcare client, confirm you have a business associate agreement, who you would call, and how fast you are required to tell them. Put that on one page with your incident plan.
- Keep your own restorable copies. Matter files and exhibits should be backed up in a copy that is not sitting on the same server, and you should test a restore. If you work with us on backup, that work is billed separately from managed IT; do not assume it is already included.
Brotherly Technology helps law firms and professional offices across Rome, Northwest Georgia, Atlanta, Chattanooga and the Southeast lock down matter files, set MFA on document systems, and build an incident plan that includes healthcare-client notice. If you'd like a short review of where your client files actually live, give us a call.
Sources:
- HIPAA Journal: "Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals" (Oct. 23, 2026). Source for the 196,645-patient figure, the privileged-information statement, and the list of data types.
- Tarter Krinsky & Drogin LLP, Notice of Security Incident (dated Sept. 4, 2026), sample filed with the California Attorney General. Source for all company-confirmed quotes, dates, law-enforcement notice, and Cyberscout monitoring.
- California Attorney General: Submitted Breach Notification Sample, Tarter Krinsky & Drogin LLP. Listing for the same notice; records breach dates as Sept. 9 and Sept. 10, 2025.