Summary
- Environment: Law-firm network and files containing personal information
- Operational impact: Possible exposure of identity, financial and healthcare information
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 24, 2026; updated as evidence emerges.
What happened
Dill Dill Carr Stonbraker and Hutchings, P.C. reported unauthorized network access between October 22 and November 11, 2025. On June 1, 2026, the firm determined that personal information may have been accessed or copied. The June date marks that finding, not an established initial detection date. [1][2]
Impact
The firm’s website notice lists names, dates of birth, Social Security or other government identification numbers, passport details, financial-account and payment-card information, login credentials, and medical or insurance information as potentially involved. It does not establish that every field was involved for every person, or give a total affected population. [2]
Timeline
Unauthorized-access window began
The firm’s investigation dated the access window to October 22–November 11.
[2]Possible personal-data access determined
The firm determined that personal information may have been accessed or copied.
[2]Website notice updated
The website notice is marked updated October 20.
[2]California sample letter dated
The sample notification carries an October 22 date.
[1]Briefing updated
This briefing was last reviewed and updated on October 24, 2026.
Threat Group & Attack Vector
The firm disclosed unauthorized access to its network without identifying the initial access method or an attacker. The notices do not establish ransomware use. [1][2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Dill Dill secured its network, investigated and reviewed files to identify affected information. Its October 20 website notice said it was unaware of misuse and provided contact details and monitoring guidance. [2]