Cybersecurity Breach Exposes Sensitive Data of Nearly 13,000 New Jersey Patients A cybersecurity breach at Greenbaum Rowe Smith & Davis LLP, a New Jersey-based law firm serving healthcare providers, has compromised the personal and medical information of approximately 12,800 patients. The incident, discovered after suspicious activity was detected within the firm’s network, involved unauthorized access to files containing protected health data. Affected records may include names, Social Security numbers, medical details, and health insurance information, though the firm has not confirmed whether all categories of data were exposed for every individual. The breach impacts patients linked to multiple major New Jersey health systems, prompting notifications and free identity protection services for those affected. Healthcare remains a prime target for cybercriminals due to the high value of medical and personal data. The law firm’s forensic investigation is ongoing, with no public indication of how the breach occurred or whether the exposed data has been misused. This incident adds to a growing trend of cyberattacks targeting legal and healthcare sectors in the region.

Cyberattack on New Jersey Law Firm Exposes Nearly 13,000 Patients’ Sensitive Data A cyberattack on New Jersey-based law firm Greenbaum Rowe Smith and Davis compromised the protected health information (PHI) of 12,801 individuals, including patients from major healthcare providers. The breach, detected on November 27, 2025, involved unauthorized access to the firm’s systems via a compromised user account. Following the discovery, Greenbaum reset passwords, notified law enforcement, and launched an investigation, which concluded on April 15. The probe confirmed that an unauthorized third party accessed and acquired sensitive data, including names, addresses, Social Security numbers, dates of birth, medical records, and health insurance details. The breach was publicly listed on May 18 by the U.S. Department of Health and Human Services’ Office for Civil Rights, as required for incidents affecting 500 or more individuals. Greenbaum represents prominent healthcare systems, including Atlantic Health System, Hackensack Meridian Health, and Trinitas Regional Medical Center, and the breach may have impacted patients across all three. While there is no evidence the stolen data has been misused or published, affected individuals are being notified via mailed letters. Hackensack Meridian Health, the state’s largest healthcare provider, acknowledged the incident, emphasizing its concern for those affected. Though the breach did not occur on its own systems, the organization stated it is coordinating with Greenbaum on the response. In response to the attack, Greenbaum has strengthened its cybersecurity measures and is offering identity theft protection services and a dedicated call center for impacted individuals. Those affected can enroll in the services by September 29 via a provided hotline or website.

New Jersey Law Firm Breach Exposes Nearly 13,000 Patients’ Sensitive Data A cybersecurity breach at New Jersey-based law firm Greenbaum Rowe Smith & Davis LLP has compromised the personal and medical information of approximately 12,800 patients across multiple major health systems. The incident, discovered after suspicious activity was detected within the firm’s network, exposed data tied to Atlantic Health System, Hackensack Meridian Health, and Trinitas Regional Medical Center. The unauthorized access involved files containing protected health information (PHI), which may include names, Social Security numbers, medical records, and health insurance details, though not all data categories were necessarily exposed for every individual. The firm has begun notifying affected patients and is offering free identity theft protection and credit monitoring through IDX, along with a dedicated assistance line for inquiries. Greenbaum Rowe, which provides legal services to healthcare providers, is among the latest third-party vendors to fall victim to cybercriminals targeting the sector. Healthcare organizations and their partners remain prime targets due to the high value of patient data. Investigations into the breach are ongoing, with no public evidence yet of misuse of the exposed information. The incident adds to a growing list of New Jersey healthcare breaches under review by the U.S. Department of Health and Human Services’ Office for Civil Rights.