Shamis & Gentile P.A., one of the nation's premier class action law firms specializing in data breach cases, is investigating the Thomas Safran and Associates data breach. If you were affected by the data breach, your sensitive personally identifiable information may have been exposed, and you may be eligible for compensation. About Thomas Safran and Associates Thomas Safran & Associates is a real estate development and management company based in Brentwood, Los Angeles. Since its founding in 1974, the company has focused on developing, owning, and managing affordable, luxury, and mixed-use rental housing throughout Southern California. The company is known for its commitment to affordable housing, having developed over 6,300 units, with the majority located in Los Angeles County. Thomas Safran & Associates also manages most of its properties, employs approximately 250 people, and has a significant number of new units under construction or in preconstruction. What Happened? On or around Sept. 8, 2025, Thomas Safran & Associates detected suspicious activity on its network. The company responded quickly by securing its systems and hiring outside forensic experts to investigate. It was determined that an unauthorized party accessed a server containing confidential information. According to public disclosures, the PLAY ransomware group claimed responsibility for the attack and threatened to publish stolen data, which may have included private and personal confidential data

On Sept. 8, 2025, Thomas Safran & Associates, a real estate development and management company based in Los Angeles, experienced a significant data breach involving unauthorized access to a confidential computer server. The cybersecurity event The breach was first identified when suspicious activity was detected on the company’s network. Immediate steps were taken to secure the environment, and outside computer forensic experts were engaged to assist with the investigation. Further analysis revealed that the breach was caused by a ransomware attack carried out by the PLAY ransomware group, who claimed responsibility on the dark web on Sept. 17, 2025. The group threatened to publish the stolen data within days, stating that they had obtained private and personal confidential data, client documents, budget, payroll, accounting, tax records, IDs and financial information. The investigation determined that the compromised documents included personally identifiable information (PII) such as names, dates of birth, addresses and Social Security numbers. The breach affected an undisclosed number of individuals, including residents and possibly employees, given the nature of the information stored on the targeted server. The incident was officially disclosed to the California Attorney General’s office on Nov. 24, 2025. Thomas Safran and Associates’ response In response to the breach, Thomas Safran & Associates took several immediate and ongoing actions to protect affected indivi