Cyberattack on New Jersey Law Firm Exposes Nearly 13,000 Patients’ Sensitive Data A cyberattack on New Jersey-based law firm Greenbaum Rowe Smith and Davis compromised the protected health information (PHI) of 12,801 individuals, including patients from major healthcare providers. The breach, detected on November 27, 2025, involved unauthorized access to the firm’s systems via a compromised user account. Following the discovery, Greenbaum reset passwords, notified law enforcement, and launched an investigation, which concluded on April 15. The probe confirmed that an unauthorized third party accessed and acquired sensitive data, including names, addresses, Social Security numbers, dates of birth, medical records, and health insurance details. The breach was publicly listed on May 18 by the U.S. Department of Health and Human Services’ Office for Civil Rights, as required for incidents affecting 500 or more individuals. Greenbaum represents prominent healthcare systems, including Atlantic Health System, Hackensack Meridian Health, and Trinitas Regional Medical Center, and the breach may have impacted patients across all three. While there is no evidence the stolen data has been misused or published, affected individuals are being notified via mailed letters. Hackensack Meridian Health, the state’s largest healthcare provider, acknowledged the incident, emphasizing its concern for those affected. Though the breach did not occur on its own systems, the organization stated it is coordinating with Greenbaum on the response. In response to the attack, Greenbaum has strengthened its cybersecurity measures and is offering identity theft protection services and a dedicated call center for impacted individuals. Those affected can enroll in the services by September 29 via a provided hotline or website.