--- title: "Dill Dill network data incident" description: "Dill Dill disclosed possible copying of personal information during unauthorized network access in October and November 2025." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-24" canonical_url: "https://www.ally.security/incidents/dill-dill-network-data-incident-2025" markdown_url: "https://www.ally.security/incidents/dill-dill-network-data-incident-2025.md" stix_url: "https://www.ally.security/incidents/dill-dill-network-data-incident-2025/stix.json" --- # Dill Dill network data incident The law firm’s 2026 notice describes a 2025 network intrusion and a later finding that personal information may have been copied. Last modified Oct 24, 2026 · 2 sources ## Summary - **Environment:** Law-firm network and files containing personal information - **Operational impact:** Possible exposure of identity, financial and healthcare information - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [Dill Dill Carr Stonbraker and Hutchings, P.C.](https://dillanddill.com/) reported unauthorized network access between October 22 and November 11, 2025. On June 1, 2026, the firm determined that personal information may have been accessed or copied. The June date marks that finding, not an established initial detection date. [1](#source-1) [2](#source-2) ## Impact The firm’s [website notice](https://dillanddill.com/wp-content/uploads/2026/10/Website-Notice.pdf) lists names, dates of birth, Social Security or other government identification numbers, passport details, financial-account and payment-card information, login credentials, and medical or insurance information as potentially involved. It does not establish that every field was involved for every person, or give a total affected population. [2](#source-2) ## Timeline ### October 22, 2025 — Unauthorized-access window began The firm’s investigation dated the access window to October 22–November 11. [2](#source-2) ### June 1, 2026 — Possible personal-data access determined The firm determined that personal information may have been accessed or copied. [2](#source-2) ### October 20, 2026 — Website notice updated The [website notice](https://dillanddill.com/wp-content/uploads/2026/10/Website-Notice.pdf) is marked updated October 20. [2](#source-2) ### October 22, 2026 — California sample letter dated The [sample notification](https://oag.ca.gov/system/files/Dill%20Dill%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf) carries an October 22 date. [1](#source-1) ### October 24, 2026 — Briefing updated This briefing was last reviewed and updated on October 24, 2026. ## Threat Group & Attack Vector The firm disclosed unauthorized access to its network without identifying the initial access method or an attacker. The notices do not establish ransomware use. [1](#source-1) [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Dill Dill secured its network, investigated and reviewed files to identify affected information. Its October 20 website notice said it was unaware of misuse and provided contact details and monitoring guidance. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Notice of Data Breach — California sample letter official · Dill Dill Carr Stonbraker and Hutchings · Oct 22, 2026 ### Notice of Cyber Event — Updated October 20, 2026 official · Dill Dill Carr Stonbraker and Hutchings · Oct 20, 2026
Evidence ledger Review the supporting structured claims. 1. **Occurred At · 100% confidence · current** Possible personal-data access determined: 2026-06-01 2. **Occurred At · 100% confidence · current** Website notice updated: 2026-10-20 3. **Resulted In · 100% confidence · current** Dill Dill network data incident: Possible personal-data access determined 4. **Resulted In · 100% confidence · current** Dill Dill network data incident: Sample notification letter dated 5. **Resulted In · 100% confidence · current** Dill Dill network data incident: The firm said it had no indication of related identity theft or fraud in its notice updated October 20. 6. **Resulted In · 100% confidence · current** Dill Dill network data incident: The review identified files relating to individuals; possible data included names, birth dates, Social Security and other government identifiers, passport details, financial-account or payment-card information, logins, and medical or health-insurance information. 7. **Affected Organization · 100% confidence · current** Dill Dill network data incident: Dill Dill Carr Stonbraker and Hutchings, P.C. 8. **Ended At · 100% confidence · current** Dill Dill network data incident: 2025-11-11 9. **Resulted In · 100% confidence · current** Dill Dill network data incident: Website notice updated 10. **Began At · 100% confidence · current** Dill Dill network data incident: 2025-10-22 11. **Occurred At · 100% confidence · current** Sample notification letter dated: 2026-10-22 12. **Resulted In · 100% confidence · current** Dill Dill network data incident: Dill Dill determined on June 1, 2026 that personal information may have been accessed or copied during a cyber event between October 22 and November 11, 2025. 13. **Resulted In · 100% confidence · current** Dill Dill network data incident: Dill Dill investigated the event, secured its network, reviewed the affected information and offered contact and account-monitoring guidance.