INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
Manhattan Law Firm Exposes PHI of 197,000 Individuals
|
2026-10-23 10:00
CRITICAL
HIGH
DATA BREACH
Executive Summary
AI-generated
A data breach at Manhattan Law Firm, Tarter Krinsky & Drogin, was reported on October 23, 2026, involving the protected health information of approximately 196,645 patients of its healthcare clients. The law firm's computer environment showed suspicious activity from September 10, 2025, to September 9, 2025, which led to an investigation by third-party digital forensics specialists confirming unauthorized access to some servers intermittently during that time. This incident is categorized as a data breach involving PHI and has affected individuals in the healthcare sector. The attack works by exploiting vulnerabilities in the law firm's computer environment, allowing an unauthorized party to access certain files on the servers. As of now, notification letters are being mailed to the affected individuals, and additional cybersecurity measures have been implemented to prevent similar incidents in the future.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
healthhealth
financefinance
legallegal
Incident Timeline
July 9, 2025
Threat actors exploited a vulnerability in the firm's network to gain unauthorized access and exfiltrate PHI of 197,000 individuals.
Click on any entity below to view its context and source!
industry
Legal
General Document Context
industry
Health
General Document Context
industry
Finance
General Document Context
between July 9, 2025
An unauthorized third party accessed some of the Manhattan Law Firm's servers intermittently between July 9, 2025, and September 9, 2025.
September 9, 2025
Young C. Park DDS, PC reported a data breach to the HHS' Office for Civil Rights affecting approximately 12,000 individuals due to unauthorized third-party access of its servers between July 9 and September 9, 2025.
Click on any entity below to view its context and source!
industry
Legal
General Document Context
industry
Health
General Document Context
industry
Finance
General Document Context
organisation
the HHS’ Office for Civil Rights
Young C. Park DDS (Park Dental)
Young C. Park DDS, PC, the operator of Park Dental in Roanoke, Virginia, has reported a data breach to the HHS’ Office for Civil Rights that has affected approximately 12,000 individuals.
September 10, 2025
Threat actors used malicious software to target the computer environment of a Manhattan law firm on September 10, 2025.
Click on any entity below to view its context and source!
industry
Legal
General Document Context
industry
Health
General Document Context
industry
Finance
General Document Context
April 2026
Threat actors used email security incident to target Heritage Pediatrics PLLC in April 2026.
Click on any entity below to view its context and source!
organisation
Heritage Pediatrics
Heritage Pediatrics PLLC
Heritage Pediatrics
Heritage Pediatrics PLLC in San Antonio, Texas, has started notifying individuals affected by an April 2026 email security incident.
June 10, 2026
Threat actors exploited a vulnerability in the firm's network to gain unauthorized access and exfiltrate PHI of 197,000 individuals.
Click on any entity below to view its context and source!
industry
Legal
General Document Context
industry
Health
General Document Context
industry
Finance
General Document Context
between June 10, 2026
Threat actors used unknown means to access and exploit the Manhattan Law Firm's systems intermittently between June 10, 2026, and July 22, 2026.
July 22, 2026
Threat actors exploited vulnerabilities to gain unauthorized access to the personal health information of 197,000 individuals at a Manhattan law firm between June 10 and July 22, 2026.
Click on any entity below to view its context and source!
industry
Legal
General Document Context
industry
Health
General Document Context
industry
Finance
General Document Context
October 19, 2026
Threat actors exploited a vulnerability in the firm's network to gain unauthorized access and exfiltrate PHI of 197,000 individuals.
Click on any entity below to view its context and source!
industry
Legal
General Document Context
industry
Health
General Document Context
industry
Finance
General Document Context
Oct 23, 2026
Tarter Krinsky & Drogin, a Manhattan-based law firm, reported a data breach involving confidential and protected health information of 196,645 patients.
Click on any entity below to view its context and source!
industry
Legal
General Document Context
industry
Health
General Document Context
industry
Finance
General Document Context
tactic
Data Breach
Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals
Posted By
Steve Alder
on Oct 23, 2026
general_metric
197,000 Individuals
Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals
Posted By
Steve Alder
on Oct 23, 2026
organisation
Tarter Krinsky & Drogin
The law firm Tarter Krinsky & Drogin has reported a breach of the protected health information of 196,645 patients of its healthcare clients.
organisation
Park Dental
Data breaches have also been announced by Park Dental in Virginia and Heritage Pediatrics in Texas.
organisation
Heritage Pediatrics
Data breaches have also been announced by Park Dental in Virginia and Heritage Pediatrics in Texas.
2026/10/23
Threat actors exploited vulnerabilities to breach the security of Manhattan Law Firm, exposing personally identifiable information (PHI) of 197,000 individuals.
Click on any entity below to view its context and source!
organisation
Data Breach
Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals.
organisation
Social Security
The types of data involved varied from individual to individual and may include some or all of the following: name, Social Security number, driver’s license number, date of birth, international tax identification number, passport number, tax identification number/individual tax identification number, financial account information, payment card information, username & password, medical informatio…
organisation
username & password
The types of data involved varied from individual to individual and may include some or all of the following: name, Social Security number, driver’s license number, date of birth, international tax identification number, passport number, tax identification number/individual tax identification number, financial account information, payment card information, username & password, medical informatio…
Intelligence Sources
HIPAA Journal
2026-10-23
Unpublish from Social Media?
Are you sure you want to delete this podcast video from all synchronized social networks (YouTube, Facebook, Threads)?
Important:
Due to Meta API restrictions, Instagram Reels cannot be deleted automatically via API by third-party apps.
View Profile to Delete Manually
View Profile to Delete Manually
Tactical Intelligence
Report Intelligence Issue
Podcast Options
Generate
Incident Version History
CURRENT VERSION
Last Updated: 2026-10-24T10:56
Comprehensive Tactical Telemetry
Highly Correlated Entities
10x
timeline
Temporal Reference
Oct 23, 2026
date
8x
organisation
Identified Entity
Data Breach
entity
3x
industry
Targeted Sector
Legal
sector
2x
general metric
Individuals
197,000
individuals
2x
general metric
October
19
october
Contextual Telemetry
Context Block
2 METRICS
tactic
Cyber Operation Type
Data Breach
tactic
general metric
Patients
196,645
patients
Click on any entity below to view its context in the main text!
Selective Unpublish
Select the networks you want to remove this post from. The system will try to delete the real post through the API and clean the database so you can publish it again.
By navigating this website, you accept the use of strictly necessary technical cookies for session security and basic platform functionality. We do not use tracking or advertising cookies. Read our Privacy Policy.