HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)LowContained

Tarter Krinsky & Drogin LLP

bd_0f270b92e6878227 · schema v1 · pii pii-v2

Severity

Low

Discovered

Sep 10, 2025

Filed

Sep 15, 2026

To disclose

12 months

Affected

Not disclosed

Linked

9 filings

Confidence

69%

Full breach record for Tarter Krinsky & Drogin LLP →

Tarter Krinsky & Drogin LLP (TKD), a law firm, experienced unauthorized access to certain servers between July 9, 2025, and September 9, 2025. TKD became aware of suspicious activity on September 10, 2025. The investigation determined that protected health information (PHI) and names of individuals were viewed or obtained by an unauthorized actor. TKD engaged third-party forensic specialists, notified federal law enforcement, and implemented additional cybersecurity measures. Affected individuals are offered credit monitoring services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 10, 2025 → Notified Sep 4, 2026359d ✗ CA 60-day late12 months discovery → filing

Incident timeline

undetected · 63 days

discovery → filing · 12 months / 370 days

Jul 9, 2025

Begins

Sep 10, 2025

Discovered

Sep 15, 2026

Filed

vs. sector median

+33 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

HHS OCRbd_42a43f03c9a492852026-09-15Verified
New Hampshire State AGbd_718a78f94dfa7fc22026-09-15Verified
Texas State AGbd_cea9ee41460cd42d2026-06-09 · +98dVerified
New Hampshire State AGbd_15f21ff79b0112172026-06-05 · +102dVerified

Show 4 more filings ↓up to 102d gap

Indiana State AGbd_18d9db7ac1e2d5f02026-06-05 · +102dVerified
Maine State AGbd_84538679dc6bce762026-06-05 · +102dVerified
Vermont State AGbd_89096b1050df0c002026-06-05 · +102dVerified
Massachusetts State AGbd_94f22eccb22dcf5d2026-06-05 · +102dCandidate

Name: Tarter Krinsky & Drogin LLP
norm: tarter krinsky drogin
Domain: tarterkrinsky.com

Name: Tarter Krinsky & Drogin LLP
norm: tarter krinsky drogin
Domain: tarterkrinsky.com
Industry: Professional Servicesllm

Discovered: Sep 10, 2025
Breach occurred: Jul 9, 2025 – Sep 9, 2025
Undetected for: 63 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 4, 2026
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcement

During the incident: Launched an investigation into the nature and scope of the activity with the assistance of third-party forensic specialists
Notified federal law enforcement upon becoming aware of the referenced suspicious activity
Undertook a comprehensive review of the affected files with the assistance of third-party subject matter specialists
Implemented additional cybersecurity measures to further protect against similar events moving forward
Offering immediate access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Changes made: Reviewing existing security policies
Implemented additional cybersecurity measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(370 days from discovery to filing)
Compliance flags: CA 60-day late · 359dCA AG copy ≤15d · 11d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 10, 2025
→ Notified: Sep 4, 2026
359d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Sep 4, 2026
→ AG copy submitted: Sep 15, 2026
11d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 10, 2025 → Notified: Sep 4, 2026	359d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Sep 4, 2026 → AG copy submitted: Sep 15, 2026	11d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

New Hampshire State AGJun 5 · first

Indiana State AGJun 5 · first

Maine State AGJun 5 · first

Vermont State AGJun 5 · first

Massachusetts State AGJun 5 · first

Texas State AG+4d

HHS OCR+102d

New Hampshire State AG+102d

California State AG+102d · this page

Pattern: first filing Jun 5 (NH), last Sep 15 (CA) — a 102-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629786
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2026
Raw hash: c3dbbf9b1c4a9962e6de61116ad04370b9c99a173b655b4111cbfbbd1ee06a9b

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityTarter Krinsky & Drogin LLP

Victim entityTarter Krinsky & Drogin LLP

Incidentdiscovered Sep 10, 2025

Stated responseLaunched an investigation into the nature and scope of the activity with the assistance of third-party forensic specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov