A New York law firm says hackers reached files holding health and identity details of 196,645 patients. Two smaller medical practices also reported breaches.
A Manhattan law firm, Tarter Krinsky & Drogin, says an unauthorized person got into its servers and may have taken files holding the health information of 196,645 patients. Those patients were not the firm's own clients. They were patients of the healthcare organizations the firm works for. Letters are now going out to people who were affected.
The firm noticed suspicious activity on September 10, 2025. Outside investigators confirmed that someone had accessed some of its servers on and off between July 9 and September 9, 2025. During that time, certain files were accessed or acquired. The firm says it has now finished reviewing the affected files and has added security measures.
The details differ from person to person. The firm lists the following types of data that may have been involved:
Most people will not have every item on that list. Your letter should say which of your details were involved.
The same report covers two smaller incidents at medical practices. Park Dental in Roanoke, Virginia, says an unauthorized person reached a workstation and an associate office email account between June 10 and July 22, 2026. About 12,000 people were affected. Exposed data may include contact details, x-rays, diagnoses, treatment plans, and insurance and billing information.
Heritage Pediatrics in San Antonio, Texas, found fraudulent emails being sent from one employee's email account in April 2026. That account held patient data. Letters went out on or around October 19, 2026. At the time, the practice had found no misuse of the data.
If no letter arrives, nothing in the report suggests you are affected. Notices are being mailed to the people whose files were involved. The report does not name the law firm's healthcare clients, so you cannot tell from the news alone whether your provider is one of them. The letter is the main way to find out.
If you get a letter, do not toss it as junk mail. The steps in the alert box above explain what to do, starting with reading which of your details were exposed.
The report does not say whether any of the stolen data has been misused or who was behind the intrusion. Names, Social Security numbers and medical details can be used for fraud long after a breach, so keep an eye on your mail, your credit and your insurance statements in the months ahead.
If a breach letter arrives from a law firm or medical office, read it closely and act on the steps in the alert box.
A tax law firm warns that 2026 tax scams use fake numbers, copycat websites and AI voices, and that a rushed demand for money is the biggest warning sign.
Read more: How to spot a tax scam before you send money or personal detailsA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
