Sprouse Shrader Smith PLLC, a law firm, experienced a data breach originating from an external system intrusion (hacking) in early 2025. The breach occurred on or around February 25, 2025, and was discovered on the same day. The firm completed its investigation by December 29, 2025, and began notifying affected individuals through written notices dated March 10, 2026.
The breach involved the exposure of personal identifiers, including first and last names, along with other personally identifiable information (PII) that varied by individual. While the exact total number of affected individuals across all states has not been fully disclosed, at least 90 Indiana residents were impacted. The breach notification indicates that specific details about the types of exposed information were not broadly detailed in available disclosures. No financial data, medical data, or social security numbers were explicitly indicated as compromised in the available sources.
Details can still emerge as investigations continue and notifications are processed. Organizations often update public information as new facts become known, and consumer notification periods can vary.