Dill Dill Carr Stonbraker & Hutchings, a Denver-based law firm, has filed a data breach notice with the Vermont Attorney General. Law firms hold sensitive client and personal records, and they are expected to protect that information with reasonable security measures.
Dill Dill Carr Stonbraker & Hutchings’s Data Breach Investigation
Dill Dill Carr Stonbraker & Hutchings, P.C. is a law firm based in Denver, Colorado, that represents businesses and individuals. Like any firm, it keeps files on the people it serves and on others connected to its matters, such as employees, counterparties and witnesses. Those files can contain some of the most sensitive identifiers a person has.
On October 22, 2026, the firm’s breach notice appeared in the Vermont Attorney General’s public listing of security breach notices. The entry shows that the information involved Social Security numbers and government ID numbers, which can include items such as driver’s license or passport numbers. The listing counts 18 Vermont residents among those affected. Tracking data for this matter lists a total of 2,326 people affected across the states where notice was filed, which include Vermont and Colorado.
Multi-state breaches often produce different numbers in different places. Each state attorney general publishes only the figure for its own residents, so a small number in one state’s listing does not describe the full size of the incident. Vermont also notes that its figures can rise as organizations finish determining who was affected.
The firm’s notice does not say, in the portions available to us, how the incident happened or how long unauthorized access lasted. Separately, the ransomware group Genesis publicly listed the firm as a victim on December 9, 2025, with an estimated attack date of December 5, 2025, according to ransomware monitoring sites. Dill Dill Carr Stonbraker & Hutchings has not publicly stated that its October 2026 notice relates to that claim, and this page does not assume that it does. It is mentioned only because it is part of the public record about the firm’s security.
Ransomware groups commonly steal files before posting a victim’s name on a leak site, then threaten to publish what they took. When those files are stolen from a law firm, the exposure may reach people who never hired the firm directly, because client matters often include documents about spouses, employees, business partners and family members.
Social Security numbers and government ID numbers are especially valuable to identity thieves. Together with a name and address, they can be used to open credit accounts, file false tax returns, or build convincing impersonation attempts. Unlike a password, a Social Security number cannot easily be replaced, so the risk can last for years after an exposure.
State breach notification laws generally require an organization to notify affected individuals once it determines that personal information was acquired without authorization. The notices usually describe what happened, what information was involved and what steps the organization is taking, and they often include an offer of credit monitoring. The timing of notices can vary by state, which is why people may hear about a single event at different times.
Legal and professional services firms are a frequent target for cyberattacks because they combine sensitive personal data with business records in one place, and many are small enough that their security budgets lag behind those of large corporations. Regulators and bar associations have repeatedly reminded firms that protecting confidential client information is part of their professional duty, not only a technical matter. Clients typically have no way to see how well a firm protects their data until a notice arrives.
Attorneys are looking into whether Dill Dill Carr Stonbraker & Hutchings maintained reasonable safeguards for the sensitive information it held, including how it stored and limited access to client records, and whether stronger controls could have prevented or reduced the exposure. If you received a letter from the firm, keep it, because it may contain enrollment codes and deadlines for any protection services offered.
When Did This Breach Occur?
The firm’s notice was reported to the Vermont Attorney General on October 22, 2026. Ransomware monitoring sites estimate that a separate attack on the firm took place on December 5, 2025, and that the Genesis group listed the firm as a victim on December 9, 2025. The firm has not publicly confirmed how those dates relate to its October 2026 notice, and the date when it first detected unauthorized access has not been made public in the sources available to us.
What Information Was Breached?
The Vermont listing identifies two categories of information: Social Security numbers and government ID numbers. The listing does not break down which category applied to which individuals, and the firm has not publicly described whether other kinds of records, such as financial account or health details, were involved. This page will be updated if the firm or a regulator releases more information.
What You Can Do
If you received a notice related to Dill Dill Carr Stonbraker & Hutchings or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Dill Dill Carr Stonbraker & Hutchings
If you are a current or former client of Dill Dill Carr Stonbraker & Hutchings, or you received a notice letter about this incident, you may have legal options for holding the firm accountable for how it protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
