Loading story…
DocketWise, a case management platform used by U.S. immigration attorneys, disclosed a breach affecting 116,666 individuals after threat actors gained unauthorized access to credentials for a third-party partner instance and used valid credentials to clone repositories in a data migration pipeline containing unstructured customer data. The exposed information varied by person but may have included Social Security numbers, tax IDs, passport and driver’s license numbers, dates of birth, financial and payment data, medical information, health insurance details, and account credentials. DocketWise told Maine regulators it had no evidence the incident specifically targeted immigration firms or that the data had been publicly released.
The breach affected clients of five named law firms and added to concerns over data handling in the immigration legal sector. Separate reporting also highlighted a recent exposure involving a misconfigured Amazon bucket tied to Dalbir Singh and Associates, PC in New York City, which reportedly left about 111,000 immigration-related files accessible until it was secured after repeated outreach. Together, the incidents exposed highly sensitive records belonging to immigration law firms and their clients.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
News reports publicly disclosed the DocketWise breach, describing it as a cyber attack impacting more than 116,000 individuals who were clients of immigration law firms using the platform. This reporting brought broader attention to the scale of the incident.
A misconfigured Amazon S3 bucket tied to Dalbir Singh and Associates, PC reportedly exposed about 111,000 immigration-related files. The bucket remained accessible until it was secured after repeated outreach, indicating a separate incident from the DocketWise breach.
DocketWise notified the Maine Attorney General's Office on April 3 about the breach, reporting 116,666 affected individuals across five law firm customers, including 13 Maine residents. The company said it had no evidence the incident specifically targeted immigration firms or that the data had been publicly released.
In the DocketWise incident, unauthorized access to credentials for a third-party partner instance allowed threat actors to use valid credentials to clone repositories in a data migration pipeline containing unstructured customer data. Exposed data may have included highly sensitive personal, financial, medical, and identity documents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DocketWise, an Austin-based provider of cloud case management and CRM software for immigration law firms, disclosed a data breach after attackers gained unauthorized access to a third-party partner repository and used valid credentials to clone repositories tied to a data migration pipeline for the DocketWise application. The company said it detected the activity in October and later reported that the incident affected at least **143,480 individuals**, while earlier public reporting had put the impact at roughly **116,000** people. The exposed information included names and highly sensitive personal data such as **Social Security numbers**, dates of birth, driver's license and passport numbers, bank account details, tax identifiers, health insurance and medical information, and non-financial account credentials. DocketWise said forensic investigators found no evidence of ongoing unauthorized access, dark web publication, or extortion linked to the stolen data, and the company reported the incident to the FBI while offering affected individuals two years of identity protection and credit monitoring services.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Multiple organizations reported **unauthorized access and data exposure events** affecting large populations, with several incidents tied to third-party systems or business associates. The Minnesota Department of Human Services notified nearly **304,000** people after a user associated with a licensed healthcare provider accessed demographic records in the *MnChoices* system (managed by vendor **FEI Systems**) beyond what was authorized; most impacted records were demographic data, with a smaller subset including some medical information and, for some, the last four digits of SSNs. Monroe University reported a **December 2024** intrusion with data exfiltration affecting about **320,973** individuals, with exposed data potentially including SSNs, government IDs, financial account information, and health/insurance data; notification letters began in early January 2026. Separately, Mid Michigan Medical Billing Service disclosed a **March 2025** cyberattack that exposed PHI for **28,185** individuals across healthcare clients, and VillageCareMAX reported a breach involving business associate **TMG Health** (details referenced as part of a broader business-associate breach update). Other items in the set describe distinct, unrelated security stories rather than the same incident: an underground-market sale of **Raaga** user data (10.2M records, including passwords stored as **unsalted MD5 hashes**), a settlement in litigation tied to the **Veradigm** breach (over 2M patients; **$10.5M** class-action settlement), and a **ransomware** incident at **Valley Eye Associates** where a group identified as **Qilin** claimed exfiltration (139 GB) and published data. Additional references include commentary on UK government handling of an **Afghan data breach** (spreadsheet emailed outside the MoD and use of an injunction) and broader analysis of healthcare breach trends and UK ambulance-service breach reporting; these provide context but do not describe the same specific event as the Minnesota DHS or other named incidents.
Jun 29, 2026