Wolf Haldenstein Confirms 3.4 Million-record Data Breach
The New York City law firm Wolf Haldenstein Adler Freeman & Herz LLP (Wolf Haldenstein) has suffered a major data breach involving the personal and protected health information of 3,445,537 individuals, according to a breach notice recently submitted to the Maine Attorney General.
Several states publish data breach summaries on the website of their Office for the Attorney General; however, many do not list how many individuals were affected, or only list the number of victims in their respective states. Maine lists the total number of individuals affected plus the number of state residents, in this case, 3,220 Maine residents. The breach report has revealed the scale of the data breach – one of the largest data breaches to occur at a law firm.
Wolf Haldenstein has offices in New York, Chicago, Nashville, and San Diego and specializes in complex litigation, including assisting clients with data breach litigation. A cyberattack on its network was suspected on December 13, 2023, when suspicious network activity was identified. Immediate steps were taken to contain the incident and prevent further unauthorized access, and a third-party digital forensics firm was engaged to investigate the activity and determine the nature and scope of any breach.
A comprehensive and time-consuming review of the affected parts of the network confirmed that names, Social Security numbers, employee identification numbers, medical diagnoses, and medical claims information had been exposed and potentially stolen in the incident. The investigation and data analysis experienced complications, hence the delay of almost a year between the discovery of the attack and the notification letters being issued.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Notifications have now been mailed to all individuals for whom address information could be found. The law firm identified a subset of affected individuals on December 3, 2024, for whom address information could not be located, and therefore they could not be notified directly. Complimentary credit monitoring services have been offered to individuals who believe they have been affected by the incident. Wolf Haldenstein said it has reviewed and enhanced its policies and procedures relating to data privacy and has taken steps to prevent similar breaches in the future.
