Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals
The law firm Tarter Krinsky & Drogin has reported a breach of the protected health information of 196,645 patients of its healthcare clients. Data breaches have also been announced by Park Dental in Virginia and Heritage Pediatrics in Texas.
Tarter Krinsky & Drogin
A data breach has been announced by the Manhattan, New York-based law firm Tarter Krinsky & Drogin, which involved confidential and attorney-client privileged information and the protected health information of 196,645 patients of its healthcare clients. Suspicious activity was identified within its computer environment on September 10, 2025. Third-party digital forensics specialists were engaged to investigate the activity and confirmed that an unauthorized third party accessed some of its servers intermittently between July 9, 2025, and September 9, 2025. During that time, certain files on the servers were accessed or acquired.
The review of the affected files has recently been completed, and notification letters are now being mailed to the affected individuals. The types of data involved varied from individual to individual and may include some or all of the following: name, Social Security number, driver’s license number, date of birth, international tax identification number, passport number, tax identification number/individual tax identification number, financial account information, payment card information, username & password, medical information, health insurance information, and biometric data. The law firm has reviewed its security policies and procedures and implemented additional cybersecurity measures to prevent similar incidents in the future.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Young C. Park DDS (Park Dental)
Young C. Park DDS, PC, the operator of Park Dental in Roanoke, Virginia, has reported a data breach to the HHS’ Office for Civil Rights that has affected approximately 12,000 individuals. The practice learned that an unauthorized third party gained access to a workstation and an associate office email account. The unauthorized access occurred intermittently between June 10, 2026, and July 22, 2026, when the unauthorized access was identified.
The investigation confirmed that email accounts had been subject to unauthorized access, and potentially there was unauthorized access to patient records. Data exposed in the incident included names, addresses, phone numbers, email addresses, birth dates, patient charts/record numbers, appointment information, provider names, referral information and communications, x-rays and related imaging, diagnoses, treatment plans and notes, and insurance and billing information. Park Dental has strengthened account and remote access security, increased monitoring, changed passwords and updated access privileges, reinforced its data privacy and security practices, and identified additional areas for further employee training.
Heritage Pediatrics
Heritage Pediatrics PLLC in San Antonio, Texas, has started notifying individuals affected by an April 2026 email security incident. The pediatric medical practice identified fraudulent emails being sent from an employee’s email account. The account was immediately secured, and an investigation was launched to determine the extent of the compromise and the nature of data exposed in the incident. Third-party cybersecurity experts were engaged to assist with the investigation and confirmed that a single email account had been compromised. The account was reviewed and found to contain patient data.
The data involved varied from individual to individual and may have included names in combination with some or all of the following: contact information, Social Security number, date of birth, driver’s license number/state identification number, passport number, financial account information, debit/credit card information, health insurance information, clinical information, diagnosis information, treatment information, treatment/procedure codes, medical record number, and health insurance information. The affected individuals were notified on or around October 19, 2026. At the time of issuing notifications, no misuse of the exposed data had been identified.
