Carney Badley Spellman Data Breach Lawsuit

Seattle law firm Carney Badley Spellman learned in March 2026 that personal information, including Social Security numbers, had been taken. Notice letters did not go out until October 2, 2026.

What Happened at Carney Badley Spellman

Carney Badley Spellman, PS is a law firm based at 701 Fifth Avenue in Seattle. Law firms like it hold sensitive files about clients, opposing parties and employees.

According to the firm’s Notice of Data Breach, the firm learned in March 2026 that information about certain people was “potentially acquired without authorization.” Working with cybersecurity specialists, the firm says it took steps to obtain the data and review it. It finished that review on September 4, 2026, and mailed letters on or about October 2, 2026.

Six Months or More Before Anyone Was Told

The firm learned of the theft in March 2026. Letters went out about six months later. Washington’s data breach law generally requires notice to affected Washington residents no more than 30 days after a breach is discovered (RCW 19.255.010).

This is not the first incident at the firm. Carney Badley Spellman notified individuals in July 2025 about an earlier incident. The October 2026 letter does not say whether the two incidents are related.

The firm has not disclosed how many people were affected. The New Hampshire filing covers about one New Hampshire resident. The Washington Attorney General has not yet posted a filing.

What Information Was Exposed?

According to the New Hampshire filing, the information included:

• First and last name
• Social Security number

Other people’s letters may list different information. Each letter states what was involved for that person.

What Is Carney Badley Spellman Offering?

The firm is offering 12 months of free single-bureau credit monitoring through Cyberscout, a TransUnion company. People must enroll within 90 days of the date on their letter, using the code in the letter.

Questions about the incident go to 1-800-405-6108, Monday through Friday, 5:00 a.m. to 5:00 p.m. Pacific Time.

Your Information Is at Risk

A name and Social Security number together are enough for criminals to open credit, file false tax returns or apply for benefits in someone else’s name. Because a Social Security number rarely changes, the risk lasts long after 12 months of monitoring ends.

Affected individuals can take these steps:

• Enroll in the free monitoring within 90 days
• Place a free credit freeze with all three credit bureaus
• Request an IRS Identity Protection PIN to block false tax returns
• Review credit reports for accounts they did not open

Do You Have Legal Options?

Law firms that hold Social Security numbers and confidential client information have a legal obligation to safeguard it and to give timely notice when it is exposed. When that obligation is not met, affected individuals may have legal rights and remedies worth discussing with an attorney. Emery | Reddy is investigating this incident on behalf of people who received a notice letter.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover. Call 916.995.5968.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Frequently Asked Questions

How many people were affected by the Carney Badley Spellman data breach?

The firm has not said. Its New Hampshire filing covers about one resident of that state. Because the firm is in Seattle, most affected people may live in Washington.

What information was exposed?

• First and last name
• Social Security number

Check your letter for the information involved for you.

Why did it take so long to get a letter?

The firm learned of the incident in March 2026 and finished its review on September 4, 2026. Letters went out about October 2. The firm has not explained why the review took about six months.

Is this the same as the firm’s 2025 data breach?

The October 2026 letter does not say. The firm notified people about a separate incident in July 2025. If you received letters about both, keep both.

What should I do if I received a letter?

• Enroll in the free monitoring within 90 days of your letter date.
• Freeze your credit with Equifax, Experian and TransUnion.
• Get an IRS Identity Protection PIN.
• Save your letter and talk with an attorney about your options.

Do I have a legal claim?

You may. Organizations that hold Social Security numbers have a duty to protect them and to tell people promptly when they are exposed. Washington law generally requires notice within 30 days of discovering a breach. If you received a Notice of Data Breach letter from Carney Badley Spellman, contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.