Cyberattack on New Jersey Law Firm Exposes Nearly 13,000 Patients’ Sensitive Data A cyberattack on New Jersey-based law firm Greenbaum Rowe Smith and Davis compromised the protected health information (PHI) of 12,801 individuals, including patients from major healthcare providers. The breach, detected on November 27, 2025, involved unauthorized access to the firm’s systems via a compromised user account. Following the discovery, Greenbaum reset passwords, notified law enforcement, and launched an investigation, which concluded on April 15. The probe confirmed that an unauthorized third party accessed and acquired sensitive data, including names, addresses, Social Security numbers, dates of birth, medical records, and health insurance details. The breach was publicly listed on May 18 by the U.S. Department of Health and Human Services’ Office for Civil Rights, as required for incidents affecting 500 or more individuals. Greenbaum represents prominent healthcare systems, including Atlantic Health System, Hackensack Meridian Health, and Trinitas Regional Medical Center, and the breach may have impacted patients across all three. While there is no evidence the stolen data has been misused or published, affected individuals are being notified via mailed letters. Hackensack Meridian Health, the state’s largest healthcare provider, acknowledged the incident, emphasizing its concern for those affected. Though the breach did not occur on its own systems, the organization stated it is coordinating with Greenbaum on the response. In response to the attack, Greenbaum has strengthened its cybersecurity measures and is offering identity theft protection services and a dedicated call center for impacted individuals. Those affected can enroll in the services by September 29 via a provided hotline or website.

Computers at the state's largest hospital network experienced interruptions for the majority of the week, according to Hackensack Meridian Health, which declared its "core clinical systems" to be operational once more. Officials from the network have remained mum on what caused the issues, but they did say that experts had been hired to investigate what occurred. The network claimed that as soon as they were made aware of the occurrence, they took quick protective action, including shutting down systems out of an abundance of caution and putting in place back-up protocols. The network stated that it was still striving to restore full operation even when core systems were reported back online.

Hackensack Meridian Health (HMH) faced a proposed class action lawsuit over a December 2019 ransomware attack. Hackensack Meridian Health experienced on December 2, 2019 and the attack crippled the computer network used by the defendant’s 17 hospitals for two days. It left facilities under the HMH umbrella unable to reschedule non-emergency surgeries and doctors and nurses were locked out of patient records. HMH did not notified patients of the ransomware incident, nor did they reported the breach to the Department of Health and Human Services. Those responsible had gained access to portions of their computer systems and made certain files unreadable via encryption, holding hostage a critical portion of HMH’s network. It contained patient records and the case relays. The attack compromised names, demographic details, dates of birth, Social Security and driver’s license numbers, employment data, and medical information protected by the Health Insurance Portability and Accountability Act of 1996—HIPAA.