Dill Dill Carr Data Breach

A Denver law firm says hackers accessed files in October 2025. The firm did not find out until June 2026, and letters did not go out until October 22, 2026, one year to the day after the access began.

Dill Dill Carr Stonbraker & Hutchings, P.C. (“Dill Dill”) is a Denver law firm that represents businesses and individuals in Colorado and the Rocky Mountain region.

According to its notice letter, on June 1, 2026, Dill Dill determined that personal information may have been accessed or copied without authorization between October 22, 2025 and November 11, 2025 as part of a cyber event. The firm’s investigation found that certain information in its systems may have been viewed or taken.

Dill Dill then reviewed the data to find out whose information was involved. Notice letters are dated October 22, 2026.

Seven Months Undetected, Then Nearly Five More Before Notice

The timeline from the firm’s letter raises questions:

• October 22 to November 11, 2025: unauthorized access to the firm’s systems
• June 1, 2026: the firm determines personal information may be involved, about seven months after the access began
• October 22, 2026: notice letters dated, 143 days after that determination

That means people learned their information may have been taken a full year after the breach started. During that time, any stolen data could have been used without their knowledge. Dill Dill’s letter does not explain the delays.

Why a Law Firm Breach Is Different

Law firms often hold sensitive records about clients and about other people involved in their cases. That can include ID documents, financial records and medical records gathered during legal matters. Some people who receive a letter may never have hired the firm themselves.

According to a filing with the Texas Attorney General, the breach affected 33,613 people, including 2,308 Texans. The Vermont Attorney General lists 18 Vermont residents. The firm also filed with the California Attorney General.

What Information Was Exposed in the Dill Dill Breach?

The firm’s sample letter does not list specific data types. According to the Texas Attorney General filing, the information involved includes:

• Name
• Social Security number
• Driver’s license number
• Government ID or passport number
• Financial account or payment card information
• Medical information
• Date of birth

Not every person had every item exposed. Each person’s letter should describe their own information.

What Is Dill Dill Offering Affected Individuals?

Dill Dill is offering complimentary credit monitoring and identity restoration services through Cyberscout, a TransUnion company. The length of the service is listed in each person’s letter.

• Enrollment deadline: within 90 days of the letter date (the sample letter is dated October 22, 2026)
• Assistance line: 1-844-772-2891, Monday through Friday, 8 a.m. to 8 p.m. Eastern Time
• Enrollment code: printed on each person’s letter

Your Information Is at Risk

This breach may include almost every piece of information an identity thief could want: a Social Security number, a government ID, a financial account number, a birth date and medical details. Together, those can be used to open new accounts, take over existing ones, or commit medical and insurance fraud.

Affected individuals can take these steps:

• Enroll in the Cyberscout services within 90 days of the letter date
• Place a free credit freeze with Equifax, Experian and TransUnion
• Review bank and card statements for charges you do not recognize
• Report a lost or exposed passport number to the State Department if you are concerned
• Review medical bills and insurance statements for services you did not receive

What Legal Options Do Affected Individuals Have?

Law firms that collect sensitive personal information have a legal duty to protect it and to notify people promptly when it is exposed. When that duty is not met, affected individuals may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Call 916.995.5968 or visit www.emeryreddy.com.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the Dill Dill data breach?

According to the Texas Attorney General filing, 33,613 people were affected, including 2,308 Texans. Vermont lists 18 residents.

What information was exposed?

According to the Texas filing, the information involved includes:

• Name and date of birth
• Social Security number
• Driver’s license, government ID or passport number
• Financial account or payment card information
• Medical information

Why did it take a year to notify people?

The access happened October 22 to November 11, 2025. The firm says it determined personal information was involved on June 1, 2026, and sent letters October 22, 2026. The firm has not explained either delay.

I never hired this law firm. Why did I get a letter?

Law firms often hold records about people connected to their clients’ matters, such as employees, patients or opposing parties. Your information may have been in a file the firm held for a case.

What should I do if I received a letter?

Take these steps:

• Enroll with Cyberscout within 90 days of your letter date
• Freeze your credit
• Watch your financial and medical statements
• Call 1-844-772-2891 with questions

Could scammers use this breach to contact me?

Yes, that is a common follow-up risk. Scammers sometimes send emails, texts or calls that mention a real breach by name to seem trustworthy. Do not click links or share codes or passwords with anyone who contacts you about the breach. Use the phone number printed on your official letter instead.

Do I have a legal claim?

Possibly. Law firms and other businesses that collect Social Security numbers, ID numbers and financial information have a duty to protect it and to tell people promptly when it is exposed. If that duty was not met, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.