TorHoerman Law, LLC data breach

What we know

TorHoerman Law, LLC is a prominent national law firm specializing in complex civil litigation, mass torts, personal injury, and product liability cases. Because the firm represents plaintiffs in highly sensitive legal matters—including medical device and pharmaceutical litigation, environmental contamination cases, and catastrophic injury claims—it routinely collects, processes, and maintains an extraordinary volume of confidential client information. This documentation includes detailed intake questionnaires, private medical records, employment histories, financial disclosures, and sensitive personally identifiable information (PII) necessary for building and prosecuting complex legal claims. Consequently, the firm serves as a central repository for intensely private data belonging to thousands of clients nationwide.

In 2025, TorHoerman Law, LLC reported a significant data security incident to the Montana Attorney General, alerting affected individuals that their private information had been compromised. While the exact vector of the breach—whether resulting from an advanced phishing campaign, a zero-day vulnerability in file-sharing infrastructure, or unauthorized access to internal databases—is subject to ongoing technical investigation, incidents within the legal sector typically exploit vulnerabilities in legacy client management systems or third-party vendor platforms. Law firms are prime targets for cybercriminals because a single successful network intrusion can yield a goldmine of unencrypted, highly sensitive documents that span multiple legal domains.

The data exposed in the TorHoerman Law breach likely includes a comprehensive array of sensitive personal identifiers, financial records, and medical documentation. The compromise of Social Security numbers, dates of birth, and full legal names exposes victims to immediate risks of identity theft and fraudulent credit account openings. Furthermore, because law firms handle extensive client case files, the breach may have exposed intimate details regarding clients' health conditions, medical treatments, financial hardships, and legal settlements. The exposure of medical records and case-specific documentation creates severe privacy risks, as cybercriminals can weaponize this deeply personal information for targeted extortion, medical identity fraud, and sophisticated spear-phishing attacks designed to trick vulnerable litigants out of settlement funds.

As a custodian of highly sensitive client data, TorHoerman Law, LLC had profound legal, professional, and ethical obligations to safeguard this information against unauthorized disclosure. Under state common law, consumer protection statutes, and professional standards of data stewardship, law firms must implement robust administrative, physical, and technical safeguards—including multi-factor authentication, end-to-end encryption, regular penetration testing, and strict access controls—to protect client files. The occurrence of a data breach of this magnitude strongly indicates potential failures in these critical security protocols, raising serious questions about whether the firm adhered to industry-standard data protection practices.

Receiving a data breach notification letter from TorHoerman Law, LLC is a formal acknowledgment that your private information was compromised due to inadequate security measures. Under modern data breach jurisprudence, the receipt of such a notice establishes legal standing to participate in a class action lawsuit, allowing affected individuals to seek accountability and compensation without needing to demonstrate that out-of-pocket financial loss has already occurred. Our firm is currently investigating class action claims on behalf of all individuals whose data was exposed in this incident. We handle all data breach cases on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only recover fees if we successfully secure a recovery on your behalf.

See every breach reported in Montana or read what to do after a ransomware attack.