Modjarrad & Associates PC dba MAS Law Data Breach Notice (Indiana Attorney General): What Was Exposed & What To Do

Modjarrad & Associates PC, doing business as MAS Law, notified Indiana residents of a data breach in a filing reported to the Indiana Attorney General on May 20, 2026. The filing places the incident itself on July 13, 2025, and states that eight people were affected. Public detail identifies the exposed material only as personal information.

The notice is limited in scope. Method of intrusion, systems involved, and a fuller inventory of records remain undisclosed in the available filing. Even so, a law firm’s handling of client and related personal data makes any confirmed exposure consequential for the small number of people named in the notice.

Breaking down the breach

According to the Indiana Attorney General filing dated May 20, 2026, Modjarrad & Associates PC dba MAS Law experienced a data incident on July 13, 2025. The firm later notified affected Indiana residents. The filing reports eight people affected and describes the exposed data as personal information.

No further technical particulars appear in the disclosed notice. How the incident was detected, whether encryption or other controls limited access, how long unauthorized access lasted, and whether data left the firm’s environment are all unconfirmed in the public record. The gap between the July 2025 incident date and the May 2026 reporting date is noted in the filing itself; the reasons for that interval are not explained in the available summary.

Because the notice is framed as a state breach filing rather than a detailed forensic report, readers should treat only the stated facts—organization, dates, headcount of eight, and the category “personal information”—as established. Everything else remains undisclosed.

How a breach like this happens

Incidents that lead to law-firm breach notices commonly begin with one of several well-understood paths. Phishing or credential-theft messages can give an outsider a foothold in email or remote-access systems. Unpatched software, misconfigured cloud storage, or compromised vendor accounts can open similar doors. Once inside, an attacker may search file shares, case-management systems, or email archives for documents that contain names, contact details, identification numbers, or other personal data.

In many cases the first clear signal is unusual login activity, ransomware encryption, or a later discovery during routine security review. Firms then investigate, determine whose information was involved, and issue notices required by state law. None of these general patterns identifies a specific method or threat actor in the MAS Law matter; the filing simply does not attribute one. The description above is background only, not a reconstruction of this event.

Modjarrad & Associates PC dba MAS Law and its sector

Modjarrad & Associates PC operates as MAS Law, a professional corporation engaged in legal practice. Law firms of this type routinely hold client intake forms, correspondence, billing records, and documents that can include Social Security numbers, driver’s-license data, financial account details, medical or employment information tied to a case, and other identifiers needed to represent clients.

Even a small practice maintains concentrated collections of sensitive personal data because legal work depends on accurate identity and background information. A breach affecting such records therefore carries weight beyond the raw number of people involved. Clients and others whose data sit in firm systems expect confidentiality; state notification laws exist precisely because that expectation can be broken by unauthorized access. The Indiana filing confirms that MAS Law determined at least eight individuals required notice under applicable rules.

What was likely exposed

The breach notification names the exposed category as personal information. It does not list specific data elements such as Social Security numbers, dates of birth, financial account numbers, or medical details. Public detail on exact contents is therefore limited.

Organizations in the legal sector typically retain names, addresses, telephone numbers, email addresses, government identifiers, and case-related documents that may themselves contain further personal data. Whether any of those typical holdings were involved in this incident is unconfirmed. Readers should not assume a particular data type was taken solely because it is common in law-firm files; only the broad label “personal information” is stated in the notice.

Why it matters

For the eight people identified in the filing, exposure of personal information creates concrete follow-on risks. Stolen or leaked identifiers can be reused in identity-theft attempts, fraudulent account openings, or social-engineering calls that reference real personal details. Even limited data can help an attacker craft more convincing phishing or impersonation schemes.

For the firm, a confirmed incident triggers notification duties, potential regulatory scrutiny, and the practical work of supporting affected individuals. Reputational and operational costs can follow regardless of the small headcount. Because the notice does not describe containment measures or confirm whether data were exfiltrated versus merely accessed, residual uncertainty remains part of the public picture.

The modest number of affected people does not eliminate individual harm. Each person whose information was involved faces the same need to monitor accounts and guard against misuse that would apply in a larger event.

Were you affected?

If you have been a client or otherwise provided personal information to Modjarrad & Associates PC dba MAS Law and believe you may be among the eight individuals noticed, begin with the steps the firm or the Indiana filing may have recommended: carefully review any official notice you received, place fraud alerts or credit freezes if appropriate, and watch financial and credit reports for unfamiliar activity. Keep records of any correspondence about the incident.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Doing so supplies an additional, independent signal and does not replace the specific guidance in any notice you received from the firm or from state authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.