BLANK ROME LLP

Blank Rome LLP reported a data breach to the Indiana Attorney General. The breach occurred on 2026-05-21 and was reported on 2026-06-26. 168 Indiana residents were affected. 57,554 individuals affected in total.

On May 21, 2026, Blank Rome LLP experienced a social engineering incident where an unauthorized third party posed as IT support and tricked an attorney into uploading files to an external Google Drive account. The firm identified the incident within two hours, took the device offline, and deleted the files. The compromised data included names and Social Security numbers, and potentially other PII, financial, and health information. The firm engaged external cybersecurity professionals, notified law enforcement, and is offering credit monitoring to affected individuals.

Blank Rome LLP notified the New Hampshire Attorney General of a security incident on May 21, 2026, involving one NH resident. An unauthorized third party posed as IT to trick an attorney into uploading files to an external Google Drive. The files contained the resident's name, SSN, and potentially other PII. Blank Rome contained the incident, notified law enforcement, and offered one year of credit monitoring.

Blank Rome LLP based in Philadelphia, Pennsylvania, a other entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-05-28 and reported on 2026-06-26. 3,002 Texas residents were affected. 57,554 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Medical Information;Health Insurance Information;Date of Birth. Consumers were notified via U.S. Mail.

Blank Rome LLP notified Massachusetts residents of an incident involving unauthorized access to client information, including names, Social Security numbers, addresses, financial account numbers, and payment card data. The firm engaged Epiq to provide two years of credit monitoring and identity protection services to affected individuals.