Cyberattack on New Jersey Law Firm Exposed Health Data of 12,801 People
Summary
A compromised user account enabled unauthorized access to Greenbaum Rowe Smith and Davis’s systems. The firm determined that health information affecting 12,801 people was acquired; it said there is no evidence the data was published or misused.
Key points
- The law firm discovered unauthorized system access on Nov. 27, 2025, through a compromised user account.
- Its investigation concluded April 15 that an unauthorized third party acquired protected health information.
- A U.S. Department of Health and Human Services notice reported that 12,801 people were affected.
- The firm provides legal services to several New Jersey health systems, and patients at those organizations may have been affected.
- The firm said there is no evidence the stolen information was published or misused.
- The firm reset passwords, notified law enforcement, enhanced cybersecurity, and is notifying affected people by mail.
- It is offering identity theft protection and assistance through hxxps://response[.]idx[.]us/grsd/; enrollment ends Sept. 29.
Article Details
- Victim Organization
- Greenbaum Rowe Smith and Davis
- Incident Type
- Unauthorized access through a compromised user account, resulting in unauthorized acquisition of protected health information
- Incident Date
- 2025-11-27
- Data Types Exposed
- Protected health information
- Affected Records
- 12,801 people
- Operational Impact
- The firm reset passwords, notified law enforcement, investigated the incident, and enhanced its cybersecurity. It is providing identity theft protection services and a dedicated call center. The article reports no evidence that stolen information was published or misused.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Industries
HealthcareA spokesperson for Hackensack Meridian Health, the largest healthcare provider in the state, said they were concerned to learn about the data security incident involving Greenbaum.Legal servicesGreenbaum provides legal services to major hospitals and health systems, including Atlantic Health System, Hackensack Meridian Health and Trinitas Regional Medical Center. The hacking incident may have impacted patients