2 Law Group Data Theft Hacks Affect 282,100 Patients

Two Florida-based law firms with offices in other states are notifying 282,100 people whose healthcare and other information was potentially compromised in separate data theft incidents. One of the firms admitted to paying a ransom to prevent its data from being leaked on the darkweb.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

The much larger of the two breaches was reported by Coral Gables, Florida-based Zumpano Patricios PA, which practices in five U.S. states and has satellite offices in several other countries. ZP Law told the U.S. Department of Health and Human Services on July 3 that its hack affected the HIPAA-protected health information of nearly 280,000 people.

ZP Law represents healthcare providers in disputes with health insurance companies, receiving personal information from medical organizations generally on spreadsheets. The firm reported that the incident involved a cyberattack detected on May 6.

The date and time of when the intrusion began is currently unknown, ZP Law said.

The investigation into the incident determined that an unauthorized threat actor accessed and potentially exfiltrated copies of some files from ZP Law’s IT environment, the law firm said.

The ZP Law data potentially affected by the hack varies by individual but included information such as names, healthcare provider names, member ID numbers, health insurer information, dates of service, amounts charged and paid, Social Security numbers, clinical coding information and medical records, the firm said.

ZP Law did not immediately respond to Information Security Media Group’s request for comment and additional details about the breach.

LaBovick Law Group Hack

The second recent law firm breach was reported by Palm Beach Gardens, Florida-based LaBovick Law Group, which has offices in the Sunshine State and Massachusetts.

LaBovick told the Maine attorney general on July 16 that an October 2024 hacking incident affected 2,825 individuals.

The law firm said its hack was perpetrated by a “well-known ransomware group” that exfiltrated some of LaBovick’s data from an affected server.

Information potentially compromised varies among individuals but included names, addresses, dates of birth; Social Security numbers; driver’s license numbers, state-issued ID numbers, bank account information; health insurance ID numbers and policy numbers, health insurance claims history, and medical history and records.

LaBovick paid an undisclosed ransom in November 2024 and said “the cybercriminal confirmed” that the law firm’s data has been deleted and would not be leaked.

Attorney Paul Hales of the Hales Law Group, which is not involved with either the ZP Law or LaBovick Law cases, said a ransom demand puts a law firm in a precarious position of negotiating with cybercriminals.

“Every law firm should carefully evaluate the ethical, legal and business consequences to prepare its response to a ransom demand. This is also a critical continuing legal education topic,” he said.

LaBovick did not immediately respond to ISMG’s request for additional details about the incident, including the cybercrime group claiming responsibility and the ransom amount paid.

Similar Attacks

The attacks on ZP Law and LaBovick Law Group are among several high-profile hacks targeting laws firms and involving healthcare data in recent years.

“Law firms, especially those litigating disputed medical billing, house records that can be used for extortion or monetized by selling through darkweb marketplaces,” said Michael Hamilton, field CISO of security firm Lumifi Cyber.

“Smaller firms are also not likely to have qualified cybersecurity practitioners on staff and are very lightly regulated as a sector – if not publicly traded, and therefore not held to a standard of practice,” he said. “The combination of poor preventive controls and valuable records make them a perfect target for record theft and extortion.”

Hales said law firms maintain highly privileged client information and need to carefully guard the privacy and security of each file. “However, HIPAA imposes additional requirements for the protection of PHI, such as the ‘minimum necessary’ standard, which restricts employee access to PHI, as well as full compliance with the Security Rule and workforce HIPAA compliance training,” he said.

“Law firm business associates should prioritize HIPAA compliance, in addition to their regular security practices, regardless of how rigorous they are,” he said.

Several previous attacks on law firms have also each affected hundreds of thousands of individuals’ PHI.

Last November, Thompson Coburn LLP, a Missouri-based national law firm that specializes in data breach law and other types of legal cases, reported that 305,088 individuals were affected in a May 2024 hack on its systems affecting healthcare sector client, Presbyterian Healthcare Services in New Mexico (see: Law Firm Hack Compromises Health System’s Patient Data).

In July 2023, global law firm Orrick, Herrington & Sutcliffe, which also provides data breach litigation services, reported to state and federal regulators a hacking incident affecting several healthcare sector clients and a total of about 638,000 individuals.

Orrick in April 2024 agreed to an $8 million settlement to resolve a consolidated proposed class action lawsuit filed against the firm in the wake of the data breach, which affected clients including vision benefits plan EyeMed and dental insurance plan provider Delta Dental (see: Law Firm to Pay $8M to Settle Health Data Hack Lawsuit).

As of Wednesday, several national law firms had issued public statements in recent days saying they are investigating the ZP Law data breach for possible class action litigation. One such lawsuit has already been filed against ZP Law in a Florida federal court.