HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDFinancial accountMediumContained

Gehry Partners LLP

bd_aebbbcf440f9e42c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 8, 2025

Filed

Feb 13, 2026

To disclose

36 weeks

Affected

Linked

3 filings

Confidence

64%

Full breach record for Gehry Partners LLP →

Gehry Partners, LLP notified the Massachusetts Attorney General of a data privacy incident. On June 8, 2025, the firm became aware of a network disruption. Investigation revealed an unauthorized actor accessed and acquired data between June 6 and June 9, 2025. The firm secured its network, took parts offline, retained forensic specialists, and notified federal law enforcement. One individual's personal information was confirmed to be involved. The firm is offering 24 months of credit monitoring and fraud assistance.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d36 weeks discovery → filing

Incident timeline

undetected · 2 days

discovery → filing · 36 weeks / 250 days

Jun 6, 2025

Begins

Jun 8, 2025

Discovered

Feb 13, 2026

Filed

vs. sector median

+17 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_290d875c2622d21d2026-02-12 · +1dCandidate
Vermont State AGbd_c53e1218896bac072026-02-12 · +1dVerified

Name: Gehry Partners LLP
norm: gehry partners

Name: Gehry Partners LLP
norm: gehry partners
Industry: Professional Servicesllm

Discovered: Jun 8, 2025
Breach occurred: Jun 6, 2025 – Jun 9, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 12, 2026
Affected individuals: 1nationwide
Data types: PIIIdentity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified federal law enforcement

During the incident: Secured our network environment
Took parts of our network offline
Retained independent forensic specialists
Notified federal law enforcement
Changes made: Offering immediate access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for 24 months
Providing proactive fraud assistance through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 36 weeks(250 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGFeb 12 · first

Vermont State AGFeb 12 · first

Massachusetts State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-217-gehry-partners-llp/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 13, 2026
Raw hash: 44f939e8bec431162ad5ecb41d969e91b0acf0042a705ab4fb66dac3f49bc3fd

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGehry Partners LLP

Victim entityGehry Partners LLP

Incidentdiscovered Jun 8, 2025

Stated responseSecured our network environment

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov