On June 14, 2024, the Vermont Office of the Attorney General reported a data breach involving D’Amico & Pettinicchi, LLC. The breach was first identified on April 15, 2024, and may have affected personal information such as names, addresses, and Social Security numbers of individuals stored in client files, though it is unclear how many individuals were affected.

The law firm D'Amico & Pettinicchi LLC suffered a data breach caused by external hacking on March 21, 2024, compromising the personal information of 1,899 individuals. The breach was detected nearly six weeks later on May 1, 2024, and affected individuals were formally notified on June 14, 2024. As a remedial measure, the firm offered 24 months of credit monitoring and identity theft protection services to mitigate potential risks such as fraud or unauthorized use of exposed data. The incident highlights vulnerabilities in the firm’s cybersecurity defenses, allowing external actors to infiltrate systems and exfiltrate sensitive client or employee data. While the exact nature of the stolen information (e.g., financial records, Social Security numbers, or legal documents) was not explicitly detailed, the provision of long-term credit monitoring suggests the exposure of personally identifiable information (PII) with high potential for misuse. The delayed discovery further exacerbates concerns about the firm’s incident response capabilities, as prolonged undetected access could have enabled deeper exploitation. The breach underscores the growing targeting of law firms—often repositories of highly sensitive client data—by cybercriminals seeking valuable information for identity theft, blackmail, or secondary attacks. The firm’s proactive notification and protective measures aim to restore trust, but the incident serves as a cautionary example of the reputational and financial risks associated with third-party data breaches in the legal sector.