July 6, 2026: Philadelphia-based law firm Blank Rome LLP was hit with two proposed class-action lawsuits after a May 21, 2026 cybersecurity incident that exposed sensitive client data for at least 57,554 individuals, according to a California regulator filing and Law.com reporting.
What happened
Per Morgan & Morgan's July 2026 data-breach brief and litigation summaries, an unauthorized third party called one of Blank Rome's attorneys, impersonated the firm's IT department, and convinced the attorney to upload client matter files to an external Google Drive account controlled by the attacker.
Bloomberg Law reported the suits were filed Monday, July 6, 2026, in Pennsylvania federal court, alleging Blank Rome negligently failed to protect personal information for more than 57,000 current and former clients and seeking more than $5 million in damages.
What data was exposed
- Names, addresses, emails, and phone numbers
- Social Security numbers and taxpayer IDs
- Government ID numbers
- Financial account and payment card information
- Medical and health-insurance information
Law-firm vishing wave
Blank Rome joins a 2026 cluster of fake IT support attacks against Am Law firms—including Silent Ransom Group campaigns documented by the FBI—where a single trusted employee action exfiltrates privileged client matter files without malware.
Action items if you received a notice
- Freeze credit if SSN exposure is confirmed.
- Monitor EOB statements for medical identity fraud.
- Verify follow-up communications via blankrome.com—not reply links.
Canonical record: Blank Rome 2026 breach on BreachHistory.