Hicks Thomas LLP Data Breach — Class Action Review

Hicks Thomas LLP is a prominent law firm that handles complex civil litigation, corporate counsel, commercial disputes, and high-stakes legal matters for individuals and corporate entities alike. Because of the nature of modern legal practice, law firms function as central repositories for an immense volume of highly confidential data. This includes not only internal operational records and proprietary business strategies, but also deeply sensitive client information, financial documents, privileged communications, employment records, and personally identifiable information (PII) belonging to adversaries, employees, and third parties involved in ongoing litigation.

In 2025, Hicks Thomas LLP reported a significant data security incident to the Indiana Attorney General, drawing scrutiny regarding the safety of the digital infrastructure safeguarding its files. While the exact vector of the compromise—whether driven by sophisticated phishing, an advanced ransomware deployment, or unauthorized access via a third-party vendor—remains under active investigation, law firm networks are prime targets for cybercriminals. Threat actors actively target legal entities precisely because law firms hold high-value unencrypted documents, corporate trade secrets, and comprehensive individual data sets that command a high price on the dark web or serve as leverage for extortion.

The exposure resulting from the Hicks Thomas LLP data breach encompasses a wide array of compromised information, which typically includes full names, Social Security numbers, dates of birth, financial account details, tax documents, and sensitive legal or employment records. When cybercriminals acquire Social Security numbers and dates of birth, victims face an immediate and long-standing risk of identity theft, fraudulent credit card applications, and unauthorized loans opened in their names. Furthermore, the compromise of confidential legal files and financial records creates severe vulnerabilities for corporate and individual clients, exposing them to targeted phishing schemes, corporate espionage, and financial fraud.

As a professional services entity handling sensitive private data, Hicks Thomas LLP had a legal and ethical duty to implement robust cybersecurity measures to protect this information from unauthorized disclosure. Under state common law principles, industry standards, and applicable state data protection statutes, the firm was obligated to maintain adequate network monitoring, encryption protocols, access controls, and employee training. The occurrence of a successful breach of this magnitude strongly indicates potential failures in these foundational security protocols, raising serious questions about whether the firm adhered to the standard of care required when handling sensitive personal and financial data.

Receiving an official data breach notification letter from Hicks Thomas LLP is a formal acknowledgment that your private information was compromised due to inadequate security measures. Legally, this notification establishes the necessary standing to participate in a class action lawsuit aimed at holding the firm accountable for failing to safeguard your data. Under the law, affected individuals do not need to prove that they have already suffered actual financial loss to seek recovery for the increased risk of identity theft, time spent mitigating the breach, and emotional distress. Our firm handles these data breach cases on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.