Blank Rome Data Breach
The 2026 Blank Rome data breach occurred when an attorney was deceived by a caller impersonating IT staff and uploaded files to an external account. A Texas regulator record confirms that at least 3,002 people were affected; the nationwide total has not been disclosed.
This classification is based on a reviewed lower bound; the actual impact and severity may be higher.
Exposed Data Types
2 sensitive13- Medical information
- Health insurance information
- Names
- Physical addresses
- Email addresses
- Phone numbers
- Dates of birth
- Social security numbers
- Driver's license numbers
- Government IDs
- Passport numbers
- Financial account information
- Credit cards
About This Breach
Blank Rome LLP is a U.S. law firm providing legal services to companies and institutions across multiple practice areas. The affected information was held in files connected with a client matter.
How Did the Incident Occur?
On May 21, 2026, an unauthorized caller contacted one of the firm's attorneys, posed as its IT department, and induced the attorney to upload files to an external Google Drive account. The firm detected the incident within two hours, took the device offline, and deleted the files from the external account. A file review determined around May 28 that personal information was involved.
What Information Was Affected?
Depending on the person, the information could have included names, addresses, email addresses, phone numbers, dates of birth, Social Security and taxpayer identification numbers, driver's licenses, state IDs, passports, or other government identification. Financial-account and payment-card information, medical information, and health-insurance information may also have been involved.
How Did Blank Rome Respond?
The firm took the device offline, deleted the files from the external account, investigated with external cybersecurity specialists, and notified law enforcement. It provided targeted social-engineering training, assessed additional technical measures, and offered notice recipients either 12 or 24 months of credit monitoring.
What Should Affected People Do?
Notice recipients should review credit reports, financial accounts, payment-card activity, and health-insurance statements for unfamiliar transactions. People whose Social Security or government-ID information was involved may consider a credit freeze or fraud alert. Unexpected calls or messages referring to the incident should be verified through the firm's known official channels.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
