Loading story…
DocketWise, an Austin-based provider of cloud case management and CRM software for immigration law firms, disclosed a data breach after attackers gained unauthorized access to a third-party partner repository and used valid credentials to clone repositories tied to a data migration pipeline for the DocketWise application. The company said it detected the activity in October and later reported that the incident affected at least 143,480 individuals, while earlier public reporting had put the impact at roughly 116,000 people.
The exposed information included names and highly sensitive personal data such as Social Security numbers, dates of birth, driver's license and passport numbers, bank account details, tax identifiers, health insurance and medical information, and non-financial account credentials. DocketWise said forensic investigators found no evidence of ongoing unauthorized access, dark web publication, or extortion linked to the stolen data, and the company reported the incident to the FBI while offering affected individuals two years of identity protection and credit monitoring services.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
In its disclosure, DocketWise said forensic investigators found no evidence of ongoing unauthorized activity, dark web leakage, or extortion related to the stolen data. The company also reported the incident to the FBI and offered affected individuals two years of identity protection and credit monitoring.
On May 26, 2026, reporting said DocketWise disclosed that the incident exposed sensitive personal data belonging to at least 143,480 people. Exposed data included names, Social Security numbers, dates of birth, driver's license and passport numbers, bank details, tax identifiers, health insurance and medical information, and account credentials.
By April 2026, DocketWise had disclosed a data breach affecting roughly 116,000 individuals, with exposed information including Social Security numbers according to reporting on the incident.
In October 2025, DocketWise detected unauthorized access to a third-party partner repository tied to its data migration pipeline. The company said threat actors used valid credentials to clone repositories associated with the DocketWise application.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DocketWise, a case management platform used by U.S. immigration attorneys, disclosed a breach affecting **116,666 individuals** after threat actors gained unauthorized access to credentials for a third-party partner instance and used valid credentials to clone repositories in a data migration pipeline containing unstructured customer data. The exposed information varied by person but may have included **Social Security numbers, tax IDs, passport and driver’s license numbers, dates of birth, financial and payment data, medical information, health insurance details, and account credentials**. DocketWise told Maine regulators it had no evidence the incident specifically targeted immigration firms or that the data had been publicly released. The breach affected clients of five named law firms and added to concerns over data handling in the immigration legal sector. Separate reporting also highlighted a recent exposure involving a **misconfigured Amazon bucket** tied to Dalbir Singh and Associates, PC in New York City, which reportedly left about **111,000 immigration-related files** accessible until it was secured after repeated outreach. Together, the incidents exposed highly sensitive records belonging to immigration law firms and their clients.
Jun 29, 2026
CareCloud disclosed that hackers breached an AWS environment tied to its CareCloud Health electronic health record platform and accessed a data store between March 10 and March 16, disrupting the environment before the company secured it. Breach notices filed with state attorneys general and subsequent reporting indicate the attackers claimed to have exfiltrated database data, with the incident affecting roughly **345,000 to 350,000** people in the United States. The compromised information included names, addresses, dates of birth, Social Security numbers, driver’s license and other government ID numbers, bank account and payment card details, and medical and health insurance records. CareCloud said it engaged external cybersecurity experts, removed the threat, found no evidence of persistent unauthorized access, and is offering up to **24 months** of identity theft protection and credit monitoring, while no ransomware or extortion group had publicly claimed responsibility at the time of reporting.
Aug 2, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026