Law Office Wolf Haldenstein Says Hack Affected 3.4 Million

Wolf Haldenstein Adler Freeman & Herz LLP, a law firm that represents consumers in data breach lawsuits and other disputes, has reported to regulators its own large 2023 hacking incident affecting more than 3.4 million individuals.

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

The law firm – which has offices in New York, Chicago, Nashville and San Diego – told Maine’s attorney general on Wednesday that information potentially compromised in the incident includes name, Social Security number, employee identification number, medical diagnosis, and medical claim information. Of the more than 3.4 million individuals affected, about 3,200 were Maine residents, Wolf Haldenstein told the state’s regulators.

Wolf Haldenstein said the hack was discovered in December 2023 when the firm detected suspicious activity in its network environment. “Upon discovery of this incident, Wolf Haldenstein promptly took steps to secure its network and engaged a specialized cybersecurity firm to investigate the nature and scope of the incident,” the firm’s breach notice said.

The investigation determined that an unauthorized actor accessed certain files and data stored within the firm’s network, the notice said. “Wolf Haldenstein also conducted an examination of its systems and networks using all information available to determine the potential impact and the security of data housed on its servers,” the firm said.

“Wolf Haldenstein subsequently undertook a time-consuming and detailed review of the data stored on the servers at the time of this incident to understand to whom that data relates,” the firm said. Nearly a year later, on Dec. 3, 2024, Wolf Haldenstein identified a subset of potentially affected persons but the firm was unable to locate address information to provide direct notice to that group of individuals, the law firm said.

Wolf Haldenstein had previously reported the hack to regulators in some other states, including Vermont in May. The law firm also reported the incident on Thursday to the Texas attorney general’s office as affecting nearly 328,000 Texans. But the firm’s report Wednesday to Maine’s attorney general appears to be the first and only time the law firm publicly disclosed that millions of individuals were affected by the incident.

As of Thursday, the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website did not show any HIPAA breach reports filed by Wolf Haldenstein.

An attorney representing Wolf Haldenstein in its breach report to Maine’s attorney general did not immediately respond to Information Security Media Group’s request for additional details about the incident, including whether any of the firm’s data breach litigation clients were affected by the hack.

“Wolf Haldenstein’s data breach and the tortuous investigation it took to find the breach is a law firm’s worst nightmare,” said regulatory attorney Paul Hales of the Hales Law Group, which is not involved in the Wolf Haldenstein incident.

“Maintaining system-wide HIPAA compliance is challenging but manageable for organizations with multiple locations like Wolf Haldenstein,” he said. “Strict client confidentiality is paramount in law firms, but the minimum necessary standard for access to protected health information can inadvertently be overlooked,” he said.

For law firm business associates, the HIPAA rules provide a blueprint to minimize, detect and prevent data breaches, he said.

“Wolf Haldenstein’s lengthy, painstaking breach investigation underscores the rationale for HHS OCR’s proposed Security Rule modifications that would require mapping the movement of electronic PHI throughout a HIPAA-regulated entity’s electronic information systems and a technology asset inventory,” he said.

Other Law Firm Hacks

The Wolf Haldenstein hack isn’t the first time a law firm that handles data breach related litigation has found itself reporting a major data security incident that potentially affected some of those clients.

Global law firm Orrick, Herrington & Sutcliffe in 2023 reported a hacking incident that was eventually determined to have compromised the information of about 638,000 individuals, including victims of a client’s data breach three years earlier.

In November, Orrick agreed to pay $8 million to settle a consolidated proposed class action lawsuit against law firm involving the data breach (see: Court Finalizes $8M Settlement in Orrick Data Breach Case).

Around the same time Orrick settled its class action lawsuit, another legal practice – Thompson Coburn, a Missouri-based national law firm that specializes in data breach law and other types of legal cases – also reported its own separate a hacking incident affecting 305,000 individuals. Those affected by that breach included an unspecified number of patients of a Thompson Coburn healthcare sector client, Presbyterian Healthcare Services in New Mexico (see: Law Firm Hack Compromises Health System’s Patient Data).