Tarter Krinsky & Drogin law firm breach exposes PHI of 196,645 patients; Park Dental and Heritage Pediatrics also report email breaches
Manhattan law firm Tarter Krinsky & Drogin reported a breach affecting the protected health information of 196,645 patients of its healthcare clients, along with attorney-client privileged data. An unauthorized third party intermittently accessed some of its servers between July 9 and September 9, 2025, and the activity was detected on September 10, 2025. Two smaller healthcare breaches were reported alongside it: Young C. Park DDS (Park Dental) in Virginia, with about 12,000 individuals affected, and Heritage Pediatrics PLLC in Texas. Neither the threat actor nor the initial access vector is identified for any of the three incidents.
Detalhes técnicos
- Tarter Krinsky & Drogin: Third-party forensics confirmed intermittent unauthorized server access from 2025-07-09 to 2025-09-09, with files accessed or acquired. Exposed data varied by individual: name, SSN, driver's license, date of birth, international and individual tax ID numbers, passport number, financial account and payment card information, username and password, medical and health insurance information, and biometric data. Notification letters are now being mailed.
- Park Dental (Roanoke, VA): An unauthorized party accessed a workstation and an associate office email account intermittently between June 10 and July 22, 2026. Exposed data includes contact details, birth dates, patient chart numbers, appointment and referral information, x-rays and imaging, diagnoses, treatment plans, and insurance and billing information. The breach was reported to the HHS Office for Civil Rights.
- Heritage Pediatrics (San Antonio, TX): A single employee email account was compromised in April 2026 and used to send fraudulent emails. The account contained patient data, including names, SSN, date of birth, driver's license and passport numbers, financial and card data, health insurance information, and clinical, diagnosis and treatment information. Notifications went out around October 19, 2026, and no misuse had been identified at that time.
Remediação
- Tarter Krinsky reviewed its security policies and implemented additional cybersecurity measures.
- Park Dental strengthened account and remote access security, increased monitoring, changed passwords, updated access privileges, and added employee training.
- Heritage Pediatrics secured the compromised account immediately and engaged third-party cybersecurity experts.
Linha do tempo
-
Tarter Krinsky & Drogin law firm breach exposes PHI of 196,645 patients; Park Dental and Heritage Pediatrics also report email breaches
ler a análise desta fonte ocultar
Manhattan law firm Tarter Krinsky & Drogin reported a breach affecting the protected health information of 196,645 patients of its healthcare clients, along with attorney-client privileged data. An unauthorized third party intermittently accessed some of its servers between July 9 and September 9, 2025, and the activity was detected on September 10, 2025. Two smaller healthcare breaches were reported alongside it: Young C. Park DDS (Park Dental) in Virginia, with about 12,000 individuals affected, and Heritage Pediatrics PLLC in Texas. Neither the threat actor nor the initial access vector is identified for any of the three incidents.
Technical Details
- Tarter Krinsky & Drogin: Third-party forensics confirmed intermittent unauthorized server access from 2025-07-09 to 2025-09-09, with files accessed or acquired. Exposed data varied by individual: name, SSN, driver's license, date of birth, international and individual tax ID numbers, passport number, financial account and payment card information, username and password, medical and health insurance information, and biometric data. Notification letters are now being mailed.
- Park Dental (Roanoke, VA): An unauthorized party accessed a workstation and an associate office email account intermittently between June 10 and July 22, 2026. Exposed data includes contact details, birth dates, patient chart numbers, appointment and referral information, x-rays and imaging, diagnoses, treatment plans, and insurance and billing information. The breach was reported to the HHS Office for Civil Rights.
- Heritage Pediatrics (San Antonio, TX): A single employee email account was compromised in April 2026 and used to send fraudulent emails. The account contained patient data, including names, SSN, date of birth, driver's license and passport numbers, financial and card data, health insurance information, and clinical, diagnosis and treatment information. Notifications went out around October 19, 2026, and no misuse had been identified at that time.
Remediation
- Tarter Krinsky reviewed its security policies and implemented additional cybersecurity measures.
- Park Dental strengthened account and remote access security, increased monitoring, changed passwords, updated access privileges, and added employee training.
- Heritage Pediatrics secured the compromised account immediately and engaged third-party cybersecurity experts.