Hicks Thomas Data Breach Lawsuit Investigation

Received a letter about the Hicks Thomas ransomware attack? Time is limited to protect your identity and legal rights—find out how below.

What Happened?

According to a notice filed with the Vermont Attorney General, Hicks Thomas LLP detected a ransomware event on November 29, 2024. A forensic investigation later revealed that an unauthorized actor had accessed the firm’s network as early as November 20, 2024, remaining inside until November 30, 2024.

During this window, sensitive files containing personally identifiable information (PII) and protected health information (PHI) were potentially viewed or exfiltrated. After confirming the scope of the intrusion, Hicks Thomas began notifying affected individuals on September 5, 2025.

What Information Was Exposed?

The exact data elements vary by individual, but may include:

• Full name
• Social Security number
• Driver’s license or state ID number
• Date of birth
• Bank account and routing numbers
• Medical information
• Health-insurance details

Your Next Steps

If you received a breach notice from Hicks Thomas, you should act quickly to reduce the risk of identity theft or medical fraud:

• Enroll in free credit monitoring offered in the notification letter.
• Order free credit reports from Equifax, Experian and TransUnion and look for unfamiliar activity.
• Place a fraud alert or security freeze on your credit file if you see suspicious changes.
• Monitor medical insurance Explanation of Benefits (EOB) statements for unknown procedures.
• Consider changing online passwords, especially for banking or patient-portal accounts.
• Record any monetary losses or time spent addressing the breach—this may support a future claim.

Can You File a Lawsuit Against Hicks Thomas?

Victims of data breaches frequently pursue compensation for:

• Out-of-pocket expenses (credit repair, tax filings, travel, etc.)
• Time lost dealing with fraud or account closures
• Emotional distress
• Risk of future identity theft and medical privacy violations

Several courts have recognized that ransomware-related breaches create a tangible threat of harm, opening the door for class action litigation. Eligibility often depends on whether your information was compromised and what damages you can document.

Timeline of Key Events

• Nov 20, 2024 – Nov 30, 2024: Unauthorized access to Hicks Thomas network.
• Nov 29, 2024: Ransomware detected.
• Sept 5, 2025: Breach notices mailed to affected individuals.

FAQ: Hicks Thomas Data Breach

How did the Hicks Thomas data breach happen?

The firm experienced a ransomware attack that allowed cybercriminals to infiltrate its systems for approximately 10 days before discovery.

What is Hicks Thomas doing to help victims?

The law firm is offering complimentary credit monitoring and identity-protection services, as referenced in its mailed notifications.

Will Hicks Thomas pay for damages caused by the breach?

Any additional compensation—beyond credit monitoring—typically arises from individual claims or class-action lawsuits filed by impacted persons.

Was medical information involved in the Hicks Thomas breach?

Yes. The notice confirms potential exposure of medical and health-insurance data in addition to other personal identifiers.

How do I join a Hicks Thomas data breach lawsuit?

Gather your breach letter, monitor your credit, document losses, and consult a data-privacy attorney who can evaluate your eligibility and file on your behalf.