DisclosureLens
Social EngineeringFinancial ServicesFinancePhishingData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)MediumContained

Grant Street Group, LLC

bd_0c15dc64b6d46fa7 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 11, 2026

Filed

Oct 1, 2026

To disclose

—

Affected

Not disclosed

Confidence

68%
Full breach record for Grant Street Group, LLC →

Grant Street Group, LLC notified Massachusetts residents of a data security incident involving a former third-party service provider, Blank Rome LLP. On May 21, 2026, an attorney at Blank Rome was misled via social engineering into uploading files containing personal information (including W-9 forms with names, SSNs, addresses, and signatures) to an external Google Drive folder. The files were deleted within hours. Grant Street was informed on September 11, 2026. The firm ended its relationship with Blank Rome and is offering two years of credit monitoring.

Incident timeline

undetected · 113 days

May 21, 2026

Begins

Sep 11, 2026

Discovered

Oct 1, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.