Garrison Architects reported a data breach to the Attorney General of Massachusetts, revealing that sensitive personally identifiable information (PII) under its care may have been compromised. The exposed data varies per individual but includes highly sensitive details such as names and Social Security numbers (SSNs). The company began notifying affected individuals via breach notification letters on November 7, 2025, offering 24 months of complimentary credit monitoring services as a remedial measure. While the exact nature of the security incident remains undisclosed in the public notice, the exposure of SSNs—critical identifiers tied to identity theft, financial fraud, and long-term reputational harm—indicates a severe compromise of customer trust. The breach underscores vulnerabilities in the company’s data protection frameworks, potentially exposing individuals to prolonged risks of fraud, phishing, and unauthorized financial activity. The provision of extended credit monitoring suggests the breach’s gravity, as such measures are typically reserved for incidents with lasting consequences for victims.