NJ Law Firm Breach Impacts 12.8K Healthcare Patients: What Was Reportedly Exposed & What To Do

A cybersecurity incident at Greenbaum Rowe Smith & Davis LLP, a New Jersey law firm that serves major hospitals and healthcare providers, has resulted in notifications to approximately 12,800 individuals. The firm reported the event on July 9, 2026, after detecting suspicious network activity and completing a forensic investigation. The exposed data includes personal information, medical information, and protected health information tied to patients connected to several health systems.

The scale of the incident and the nature of the data involved make it relevant to patients who received care through the firm’s healthcare clients. Notifications are being issued directly to those affected.

Inside the incident

The firm stated that it identified suspicious activity on its network and responded by conducting a forensic investigation. As a result of that review, it determined that personal information, medical information, and protected health information belonging to roughly 12,800 people may have been exposed. Notifications to the affected individuals are now underway.

No further details on the method of access, the duration of the activity, or the precise volume of records involved have been released. The firm has not attributed the incident to any specific actor or technique beyond the initial detection of suspicious network behavior.

How a breach like this happens

Incidents involving law firms that handle client data from regulated sectors often begin with unauthorized access to internal networks. Attackers may exploit remote-access tools, compromised credentials, or unpatched systems to move laterally and locate repositories that contain client files.

Once inside, the activity can remain undetected for weeks or months until monitoring tools or an external tip prompt an investigation. Forensic reviews then determine which datasets were viewed or copied, after which organizations begin the process of identifying and notifying the individuals whose information was affected.

Greenbaum Rowe Smith & Davis LLP and its sector

Greenbaum Rowe Smith & Davis LLP is a New Jersey-based law firm whose clients include major hospitals and healthcare providers in the state. Law firms in this position routinely receive and store records that originate from their clients’ operations, including materials related to patient care and regulatory compliance.

Because healthcare entities are subject to strict federal and state rules on data handling, any law firm that works with them becomes a secondary custodian of sensitive records. A compromise at the firm therefore extends the potential impact beyond its own employees to patients whose information was shared for legal or administrative purposes.

What was likely exposed

The firm has confirmed that personal information, medical information, and protected health information were involved. These categories typically encompass names, contact details, dates of birth, medical histories, treatment records, and identifiers used in healthcare settings.

The exact fields contained in each record have not been itemized publicly, and the firm has not released a full inventory of the affected datasets. Individuals receiving notifications will receive more specific descriptions of the information that pertains to them.

What's at stake

For the people notified, the primary concerns are identity misuse and unauthorized access to medical records. Personal and health data can be used to open accounts, file false claims, or target individuals for further scams.

For the firm and its healthcare clients, the incident creates obligations around notification, regulatory reporting, and potential remediation. It also underscores the downstream risk that arises when sensitive records are transferred to service providers that may not face the same level of public scrutiny as the original data holders.

If your data was in this claimed breach

Review any notification letter for instructions on free credit monitoring or identity-protection services offered in connection with the incident. Place a fraud alert or credit freeze with the major credit bureaus if you have not already done so, and monitor statements from banks, insurers, and healthcare providers for unusual activity.

You can also run a free exposure scan of your email address against known breach data to see whether your information appears in other publicly reported incidents. Keep records of all correspondence related to this event in case additional steps become necessary.

AICompiled with AI assistance from public sources and published under our editorial standards.