Blank Rome Data Breach: What Happened, Who Was Affected, and Settlement Update
The Blank Rome data breach began on May 21, 2026, when an unauthorised person reportedly impersonated someone from Blank Rome LLP’s IT department and convinced an attorney to upload files to an external Google Drive account. The incident was different from a conventional attack in which hackers directly broke into the law firm’s central computer network. Blank Rome later said the incident involved only one attorney and that its network itself had not been breached.
The exposed files contained sensitive information associated with thousands of people. Reporting based on the breach notices and lawsuits placed the affected population at approximately 57,554 individuals, with potentially involved information ranging from names and Social Security numbers to financial, medical, and government-identification information. Blank Rome’s breach appears in the California Attorney General’s official database with a May 21, 2026 incident date and a June 26, 2026 reporting date.
Several proposed class actions followed, but those early federal lawsuits did not become the current settlement case. They were voluntarily dismissed without prejudice in July 2026, and a later Florida state-court case produced a proposed settlement. As of October 31, 2026, that settlement remains subject to final court approval, so readers should distinguish the current settlement from outdated pages describing only the original federal litigation.
What to know
- The incident occurred on May 21, 2026 and reportedly relied on social engineering.
- Approximately 57,554 people were reported affected.
- The information involved varied by person and could include highly sensitive identity, financial, and health information.
- Early proposed federal class actions were dismissed without prejudice rather than decided on their merits.
- A later Florida state-court case produced a proposed $991,508 settlement.
- Eligible settlement members may claim documented losses and a pro rata cash payment under the settlement terms.
- Settlement members are also offered one year of credit monitoring without needing to submit a cash claim.
- Blank Rome denies wrongdoing, and the proposed settlement is not an admission of liability.
What Caused the Blank Rome Data Breach?
The incident reportedly began with social engineering rather than an attacker directly breaking through Blank Rome’s network security. An unauthorized person posed as a member of the firm’s IT department and instructed a Blank Rome attorney to upload confidential files to an outside Google Drive account. That approach relied on convincing a trusted employee to move the information rather than defeating the firm’s systems through a conventional network intrusion.
Blank Rome reportedly detected the incident within about two hours and began responding. According to reports based on the firm’s notice, the external files were deleted, an investigation was opened, and law enforcement was notified. Blank Rome later said that its internal network was not breached and described the incident as limited to one attorney.
That distinction does not make the exposure insignificant. A successful social-engineering attack can cause sensitive information to leave an organization’s control even when malware never penetrates the central network. It also shows why cybersecurity programs have to address employee verification, suspicious requests, file-transfer procedures, and technical controls together.
Social engineering is a technique in which an attacker manipulates a person into providing information, transferring files, revealing credentials, or taking another unsafe action. The attacker often pretends to be a trusted employee, vendor, supervisor, bank representative, or IT worker. Because the method targets human trust, a serious breach can happen without the attacker directly hacking the organization’s main network.
When Did the Blank Rome Data Breach Happen?
The incident occurred on May 21, 2026. California’s official data-breach database lists Blank Rome LLP with that breach date and shows that the incident was reported on June 26, 2026. California requires qualifying organizations to provide the Attorney General with a sample notification when notices are sent to more than 500 California residents.
People affected by the incident began receiving notification letters around that same period. Those notices explained that files involved in the incident could contain personal information and offered information about protective measures. The timing of the notification later became one of the issues mentioned in lawsuits filed after the breach.
The notification timeline should not automatically be described as unlawful delay. Different state breach-notification laws have different standards, and timing may depend on when an organization confirms the scope of an incident, identifies affected individuals, completes necessary investigation, and evaluates applicable legal requirements. The federal lawsuits were dismissed before a court reached a final ruling on whether Blank Rome violated any notification requirement.
How Many People Were Affected?
Reports concerning the breach identified approximately 57,554 people as affected. The population included individuals whose information appeared in files involved in the May incident, although Blank Rome disputed descriptions suggesting that every affected person was necessarily a client. The precise relationship of an affected person to the firm can therefore differ.
The number of affected people does not mean everyone had the same information exposed. A large collection of files can contain different data fields for different individuals, so one person’s records may include a Social Security number while another’s may contain different identity or financial information. The most useful source for an individual is therefore the person’s own notification letter.
This distinction also matters when assessing risk. Exposing an email address usually presents a different risk profile than exposing a Social Security number, passport number, or financial account information. People should base protective measures on the information actually identified in their notice rather than assuming that every category associated with the breach applies to them.
What Information Was Involved in the Blank Rome Data Breach?
The official settlement notice identifies a broad range of information that may have been involved in the incident. It explains that settlement class members’ private information included some combination of several categories rather than saying every category applied to every affected person. Those categories include identity, financial, contact, and health-related information.
Information identified in settlement materials
- Names
- Physical addresses
- Email addresses
- Telephone numbers
- Dates of birth
- Social Security or taxpayer identification numbers
- Driver’s license numbers
- State identification card numbers
- Passport numbers
- Other government-issued identification numbers
- Financial account numbers
- Payment card information
- Medical information
- Health insurance information
Information such as Social Security numbers, financial-account details, and government identification can create long-lasting identity risks because it is difficult to change. Medical and health-insurance information can create additional privacy concerns unrelated to ordinary financial fraud. The level of risk therefore depends heavily on which information was connected with a particular person.
The important wording is that the affected information varied. Someone who receives a breach notice should examine it for the information associated with their own records. An overall breach-data list should not be treated as proof that every listed item belonged to every affected individual.
Why Is a Law Firm Data Breach Significant?
Law firms can possess unusually broad collections of confidential information. Depending on the matter, their files may contain financial statements, medical records, identification documents, employment information, business records, settlement documents, litigation materials, and other sensitive information. This concentration of data can make legal organizations attractive targets for criminals.
Lawyers also operate under professional duties involving client information, although the exact legal consequences of a cybersecurity incident depend on the facts and applicable laws. A data breach does not automatically establish negligence, professional misconduct, breach of contract, or violation of a privacy statute. Those issues require proof of the applicable duty, the conduct involved, causation, and any legally recognized harm.
The lawsuits filed after the Blank Rome incident alleged that the firm failed to use adequate cybersecurity protections and employee training. Blank Rome disputed those allegations and denied wrongdoing. Because the early federal cases ended before a merits judgment, those accusations should continue to be described as allegations rather than established violations.
What Lawsuits Were Filed Over the Blank Rome Data Breach?
Multiple proposed class actions were filed in the U.S. District Court for the Eastern District of Pennsylvania during July 2026. One was Delapaz v. Blank Rome LLP, filed on July 6, 2026, and another was filed by Anthony Santana. The complaints sought relief for people whose private information was allegedly compromised.
The plaintiffs alleged that Blank Rome failed to use reasonable cybersecurity measures and appropriately protect sensitive information entrusted to the firm. Their complaints asserted various legal theories and requested monetary and other relief. Blank Rome denied wrongdoing, and none of those allegations was ultimately established through a federal trial or final judgment.
The federal litigation also encountered a threshold problem. Judges questioned whether the complaints adequately established federal subject-matter jurisdiction, and the plaintiffs later voluntarily dismissed the cases. Those dismissals occurred before the courts decided whether Blank Rome was legally liable for the underlying incident.
What Happened to Delapaz v. Blank Rome LLP?
Laura Delapaz filed Delapaz v. Blank Rome LLP, Case No. 2:26-cv-04655, in the Eastern District of Pennsylvania on July 6, 2026. An amended complaint followed on July 17, but Delapaz filed a voluntary notice of dismissal on July 21. The federal docket therefore shows that the case ended without a merits ruling.
This matters because some pages discussing the blank Rome data breach still describe Delapaz as though it were the main active lawsuit. That was an accurate description when those pages were first written, but the litigation changed afterwards. A current article should distinguish between the original federal complaints and the later Florida settlement proceedings.
The dismissal was also without prejudice, not a ruling absolving Blank Rome of liability. A voluntary dismissal without prejudice generally ends that particular action without finally deciding the underlying claims on their merits. It therefore should not be described either as a plaintiff victory or as a judicial finding that Blank Rome did nothing wrong.
A dismissal without prejudice normally ends the particular lawsuit without permanently deciding the underlying claim on its merits. Subject to statutes of limitation and other procedural rules, a claim may sometimes be asserted again in an appropriate court or later action. This differs from a final judgment after the court determines whether the defendant is legally responsible.
Why Were the Early Federal Lawsuits Dismissed?
The federal cases encountered questions concerning subject-matter jurisdiction. Federal courts have limited jurisdiction, which means a plaintiff must establish a legal basis for the federal court to hear the dispute. Merely alleging a serious data breach does not automatically create federal jurisdiction.
The plaintiffs filed their actions relying in part on diversity jurisdiction, but federal judges required them to address whether the jurisdictional requirements had been properly established. Rather than continue litigating that threshold question, the plaintiffs voluntarily dismissed the actions. The federal courts therefore never reached a final decision on the merits of the breach allegations.
This distinction is especially important for readers comparing older articles. Some pages correctly report that the July federal cases were dismissed but then conclude that no Blank Rome settlement exists. That information is now incomplete because the later Florida state-court case produced the proposed settlement currently being administered.
Is There a Blank Rome Data Breach Settlement?
Yes. The official settlement administrator confirms a proposed settlement in Anthony Santana v. Blank Rome LLP, Case No. CACE-26-011862, pending in the Circuit Court of Broward County, Florida. The court has not decided that Blank Rome did anything wrong, and Blank Rome continues to deny the allegations.
Under the agreement, Blank Rome has agreed to fund a settlement totaling $991,508. That fund is intended to cover cash payments, credit-monitoring costs, settlement administration, any attorneys’ fees and costs approved by the court, and any approved service awards. It should not be understood that $991,508 will be divided equally among all affected people.
The settlement remains proposed, not final, as of October 31, 2026. A final approval hearing is scheduled for December 14, 2026, and settlement benefits are provided only if the court approves the agreement and the necessary approval process is completed.
Who Is Included in the Blank Rome Settlement?
The official settlement notice gives a relatively straightforward class definition. A person is included if they are a living individual who was notified that private information may have been impacted in the May 2026 data incident. Certain excluded groups, including specified Blank Rome personnel, governmental entities, the assigned judge and related court personnel, and people who properly opt out, are not part of the settlement class.
That definition makes the breach notice especially important. Receiving an official notification is a key indicator that the person falls within the settlement definition, although questions about an individual’s status should be directed to the administrator. Settlement notices may also contain information needed to submit a claim.
Someone who lost the notice is not necessarily prevented from seeking assistance. The official claim portal directs people who did not receive or no longer have their notice to contact the settlement administrator. The administrator can explain the verification process rather than requiring someone to rely on an unofficial claims website.
What Can You Get From the Blank Rome Data Breach Settlement?
The settlement offers more than one type of benefit. Settlement members can potentially receive documented-loss reimbursement, a pro rata cash payment, and one year of credit-monitoring benefits under the agreement. The amount or availability of each benefit depends on the settlement’s terms and final approval.
For documented losses, a class member can submit a claim for up to $3,000 in reasonable losses related to fraud or identity theft resulting from the incident. Supporting documentation is required, and a person cannot receive duplicate reimbursement for the same expense from another source. Claims lacking adequate loss documentation may still qualify for a pro rata cash-payment option where the settlement terms permit it.
The settlement also provides a pro rata cash payment that does not require documented losses. The final amount depends on the number and type of valid claims and other settlement costs, so there is no guaranteed fixed payment for every claimant. Settlement members are also offered one year of credit monitoring without needing to submit a separate cash claim for that benefit.
What the proposed settlement currently provides
| Benefit or term | Current information |
|---|---|
| Total settlement fund | $991,508, subject to final court approval and the terms of the settlement. |
| Documented-loss payment | Up to $3,000 for qualifying documented losses related to fraud or identity theft resulting from the incident. |
| Pro rata cash payment | Settlement members may submit a claim for a pro rata cash payment without documenting losses. |
| Credit monitoring | One year of free credit monitoring is provided without submitting a cash claim, subject to settlement effectiveness. |
| Cash claim deadline | November 29, 2026. |
| Opt-out deadline | November 14, 2026. |
| Objection deadline | November 14, 2026. |
| Final approval hearing | December 14, 2026 at 8:45 a.m. Eastern Time, subject to change. |
Do You Need to File a Claim for Credit Monitoring?
No. The official settlement materials say settlement members do not need to submit a cash claim to receive the one-year credit-monitoring benefit. The settlement notice provides an activation code, but activation depends on the settlement becoming effective.
Cash benefits work differently. A settlement member who wants either documented-loss reimbursement or a pro rata cash payment must submit a valid claim by the applicable deadline. Simply remaining in the class without filing a claim will not produce a cash payment.
This distinction is worth checking before the deadline. Someone may decide not to pursue a cash claim while still keeping access to the credit-monitoring benefit if the settlement becomes final. The settlement notice should therefore be kept even when the person does not expect to submit reimbursement documentation.
What Is the Blank Rome Data Breach Claim Deadline?
The deadline to submit a valid cash claim is November 29, 2026. Claims can be submitted through the official settlement process or by mail in accordance with the administrator’s instructions. The online claim system requires identifying information from the settlement notice for recipients who received those credentials.
The exclusion and objection deadlines are earlier. Settlement members who want to opt out must follow the required procedure by November 14, 2026, and must also submit objections to the proposed settlement under the stated procedures by that date. Opting out and objecting are legally different choices.
A person who opts out gives up settlement benefits but generally preserves whatever separate rights remain concerning released claims. A person who objects remains in the settlement class and asks the court not to approve some or all of the agreement. Anyone considering separate litigation should obtain individual legal advice before assuming that opting out would produce a better result.
What Happens If You Do Nothing?
Doing nothing does not remove a settlement member from the class. According to the settlement materials, a person who remains in the settlement but does not submit a cash claim will not receive a cash payment. The person may still receive the available credit-monitoring benefit and will generally be bound by the settlement’s releases if the agreement becomes final.
That release can matter. A class member who remains in the settlement generally gives up the ability to bring another lawsuit against the released parties over claims covered by the settlement. The settlement documents define the precise scope of the release.
Doing nothing is therefore not the same as opting out. Opting out removes the person from the settlement class if the request is timely and valid, while doing nothing keeps the person in the class. That difference can matter even if the person does not intend to request cash.
How Much Will the Pro Rata Cash Payment Be?
The settlement does not promise one fixed pro rata amount for every claimant. A pro rata payment depends on the settlement formula, valid claims, and the amount remaining after approved settlement expenses. Therefore, it is misleading to advertise a guaranteed individual payout before claims are processed.
The settlement fund also pays more than claimant benefits. Administrative expenses, approved attorneys’ fees and costs, credit-monitoring costs, and approved service awards can come from the same fund. Those deductions can affect the amount remaining for distributions.
Class Counsel may also request attorneys’ fees and expenses under the settlement terms, subject to court approval. Any requested service awards for class representatives are also subject to judicial review. The final individual cash amount therefore cannot be known simply by dividing the total settlement fund by the reported number of affected people.
Did Blank Rome Admit That It Was Negligent?
No. Blank Rome denies the allegations and denies wrongdoing. The court has also not issued a final merits judgment deciding that the firm negligently caused the incident.
A settlement allows disputed litigation to end without requiring a trial and final judgment on liability. Companies may settle for many reasons, including litigation costs, uncertainty, and the time required to continue defending a case. Settlement therefore should not be described as an automatic admission that the defendant violated the law.
The same caution applies to statements taken from the complaints. Plaintiffs alleged that Blank Rome failed to use adequate cybersecurity safeguards and training, but those allegations were not proven in the federal cases. Accurate reporting should identify them as allegations rather than treating them as established fact.
Was Blank Rome’s Entire Network Hacked?
Blank Rome said no. The firm stated that the incident was limited to one attorney and that its network itself was not breached. The exposure instead reportedly occurred when confidential files were transferred to an external location after an attacker impersonated IT personnel.
That distinction helps explain how modern data breaches can occur. An attacker does not always need administrator privileges, malware, ransomware, or direct network access if an employee can be manipulated into transferring information. Strong perimeter security therefore cannot eliminate every cyber risk.
It also demonstrates why describing the event simply as “hackers broke into Blank Rome’s systems” can be misleading. The more accurate description is that an unauthorized person reportedly used social engineering to cause sensitive files to be transferred outside the firm’s control. That wording better matches the currently reported facts.
What Did Blank Rome Do After Discovering the Incident?
Blank Rome reportedly identified the incident quickly and took steps to contain it. Reporting based on the firm’s notice said the incident was identified within approximately two hours, the external files were deleted, an investigation was launched, and law enforcement was notified. Those actions formed part of the firm’s response to the event.
The firm also began identifying people whose information had been involved and later sent breach notifications. Complimentary credit monitoring was offered, and Blank Rome said it took internal steps intended to reduce similar risks. The exact effectiveness of those measures was not decided in the early federal litigation.
Plaintiffs nevertheless alleged that the firm should have had stronger safeguards in place before the incident. They also challenged aspects of the response and notification. Because the federal actions ended before a merits judgment, those competing positions remained unresolved.
Is a Blank Rome Data Breach Letter Legitimate?
A legitimate Blank Rome notification is consistent with official government records. California’s Attorney General database lists Blank Rome LLP with a May 21, 2026 incident date and a June 26, 2026 reported date. The later class settlement also has an official administrator handling notices and claims.
People should still be careful because real breaches can produce secondary scams. A criminal may send a fake settlement message, imitate the administrator, or claim that payment or sensitive credentials are required to release compensation. An unexpected email should therefore be verified independently rather than trusted simply because it mentions the real Blank Rome breach.
The safest approach is to use information from the original notice and independently verified official sources. Avoid sharing passwords, full banking credentials, or unnecessary identity information with anyone who contacts you unexpectedly. Social-engineering caution is especially appropriate here because social engineering reportedly caused the original incident itself.
What Should You Do If You Received a Blank Rome Data Breach Notice?
First, determine what information related to you was actually involved. Do not assume that every data category listed in the settlement notice was connected with your individual file. Your breach notice is more useful for understanding your personal exposure.
If highly sensitive information such as a Social Security number, government identification number, or financial-account information was involved, stronger protective measures may be reasonable. Monitoring existing accounts, reviewing credit reports, considering a credit freeze, and using the available settlement credit monitoring can reduce or identify certain risks. These precautions cannot guarantee that fraud will never occur.
People who have already experienced expenses or identity-related losses should also preserve records. Receipts, bank correspondence, fraud reports, credit records, and similar documents may support a documented-loss claim. Use the settlement administrator, not an unofficial third-party website, to determine whether specific documentation meets the settlement requirements.
What to consider after receiving a Blank Rome notice
- Read the notice carefully: Identify the specific categories of information associated with you instead of assuming every category in the breach was yours.
- Keep your settlement notice: It may contain the Unique ID, PIN, or credit-monitoring code needed for settlement benefits.
- Review your financial accounts: Look for transactions or changes you do not recognize and report suspicious activity through the appropriate institution.
- Check your credit reports: Watch for unfamiliar accounts, inquiries, addresses, or other changes that may indicate attempted identity misuse.
- Consider a credit freeze: A freeze can make certain new-account fraud more difficult when sensitive identity information has been exposed.
- Preserve documentation: Keep receipts and records if you experience fraud or identity-theft losses that may support a settlement claim.
- Review settlement deadlines: Cash claims are currently due November 29, 2026, while exclusions and objections have a November 14 deadline.
Should You Freeze Your Credit?
A credit freeze can be a useful precaution if sensitive identity information was exposed. It restricts access to a consumer’s credit file and can make it harder for someone else to open certain new accounts using that person’s identity. It does not stop every type of identity theft or fraudulent transaction.
A freeze also does not monitor existing financial accounts. Someone should still review bank and credit-card statements even when a credit freeze is in place. Existing-account fraud and certain non-credit forms of identity misuse can occur without opening a new credit account.
Whether a freeze is worthwhile depends partly on the information involved and the person’s circumstances. Someone whose Social Security number was exposed may reasonably view the risk differently from someone whose affected information consisted only of basic contact details. General online guidance cannot evaluate every individual’s risk.
Blank Rome Data Breach Timeline
Key dates in the Blank Rome data breach
| Date | What happened |
|---|---|
| May 21, 2026 | The reported social-engineering incident occurs and files are transferred to an external Google Drive account. |
| May 2026 | Blank Rome investigates, takes containment steps, and begins determining what information and individuals were affected. |
| June 26, 2026 | The breach is reported in state records, including California’s Attorney General database, and notification letters are sent. |
| July 6-7, 2026 | Proposed federal class actions are filed in the Eastern District of Pennsylvania. |
| July 21, 2026 | The early federal actions are voluntarily dismissed without prejudice before the courts decide the merits. |
| Later in 2026 | A proposed settlement is reached in the Florida state-court case Santana v. Blank Rome LLP. |
| November 14, 2026 | Current deadline for settlement exclusions and objections. |
| November 29, 2026 | Current deadline for submitting cash claims. |
| December 14, 2026 | The final approval hearing is scheduled for 8:45 a.m. Eastern Time. |
Why Some Blank Rome Data Breach Articles Are Already Outdated
The litigation developed quickly, creating an unusual search problem. Some competitor pages written during July and August accurately stated at the time that no settlement existed. Those pages can now mislead readers if they haven’t been updated, because the Florida settlement proceeding has changed the current legal status.
Some pages also continue to describe Delapaz v. Blank Rome LLP as the main active lawsuit. The federal docket now shows that Delapaz voluntarily dismissed the case, while the official settlement administrator provides a live claims process connected with the Florida Santana litigation. The current settlement status therefore matters more to many readers than headlines about the first lawsuit.
This freshness issue makes the keyword especially important for users who received a notice. Someone searching blank rome data breach may no longer want only a description of what happened in May. The person may be looking for current claim information, benefits, deadlines, and options.
What Is the Difference Between the Federal Santana Case and the Current Settlement?
Anthony Santana initially filed federal litigation concerning the Blank Rome incident. That early federal action belonged to the wave of cases that encountered jurisdictional problems and did not proceed to a merits judgment. The federal filing should not be confused with the current settlement proceeding.
The settlement administrator identifies the current settlement case as Anthony Santana v. Blank Rome LLP, Case No. CACE-26-011862, in the Circuit Court of Broward County, Florida. That state-court case is associated with the settlement benefits and deadlines currently being communicated to class members. The distinction matters when checking older court dockets or articles.
An outdated federal docket can accurately show that an earlier Santana case ended while still failing to tell a reader that a separate state-court settlement now exists. Current settlement information should therefore come from the official administrator and current court materials. That approach avoids mixing two different procedural stages.
Is the Settlement Final?
No. As of October 31, 2026, the Blank Rome settlement is proposed and still awaiting final approval. The official administrator lists a final approval hearing for December 14, 2026, at 8:45 a.m. Eastern Time.
At that hearing, the court will consider whether the settlement should be approved. It can also consider properly submitted objections, requested attorneys’ fees and costs, and any proposed service awards. The schedule can change, so settlement members should verify the hearing details before relying on them.
Benefits dependent on final approval should not be described as completed distributions. The one-year credit-monitoring benefit and cash payments remain subject to the settlement becoming effective under its terms. This article should therefore be reviewed again after the December hearing.
Does the Settlement Mean Blank Rome Was Found Liable?
No. Neither the proposed settlement nor the earlier complaints amount to a court judgment finding Blank Rome legally responsible. Blank Rome continues to deny wrongdoing.
That distinction affects how the incident should be described. It is accurate to say plaintiffs alleged that Blank Rome used inadequate safeguards or training. It would be inaccurate to present those allegations as findings made after a trial.
The same principle applies to damages. A settlement benefit is not proof that every class member suffered identity theft, fraud, or a measurable financial loss. Class settlements can provide benefits without requiring each member to prove every element of a separate lawsuit.
What Makes the Blank Rome Data Breach Important?
The incident provides a practical example of how cybersecurity risk extends beyond technical defenses. A strong network security system cannot prevent every breach if an attacker successfully persuades a trusted person to move confidential files outside controlled systems. Human verification procedures can therefore be as important as firewalls and security software.
The breach also shows why law firms are valuable targets. Their files can combine identity documents, financial information, medical records, business material, and confidential communications in one place. One successful attack can therefore expose information belonging to people who may not even think of the law firm as an organization holding significant personal data about them.
Finally, the litigation illustrates why legal updates matter for breach coverage. The story moved from notification, to federal lawsuits, to voluntary dismissals, and then to a proposed state-court settlement in only a few months. An article that was completely accurate in July can already be substantially outdated by October.
Conclusion
The blank rome data breach began with a May 21, 2026 social-engineering incident in which an unauthorized person reportedly impersonated IT personnel and persuaded a Blank Rome attorney to transfer sensitive files to an external Google Drive account. Approximately 57,554 individuals were reported affected, although the types of information involved differed from person to person. Blank Rome said its network itself was not breached and that the incident was limited to one attorney.
The legal status has changed significantly since the first lawsuits appeared. The early federal proposed class actions were voluntarily dismissed without prejudice, but a later Florida state-court action produced a proposed $991,508 settlement offering documented-loss reimbursement, a pro rata cash payment, and one year of credit monitoring. As of October 31, 2026, the settlement still awaits final approval.
Affected people should pay particular attention to the current deadlines. Cash claims are presently due November 29, 2026, while exclusions and objections are due November 14, and the final approval hearing is scheduled for December 14. Because the case remains active and Blank Rome denies wrongdoing, future updates should continue separating verified developments, allegations, and settlement terms rather than treating them as the same thing.
Frequently asked questions
What happened in the Blank Rome data breach?
The Blank Rome data breach occurred on May 21, 2026 and reportedly involved someone impersonating a member of the firm’s IT department. A Blank Rome attorney was persuaded to transfer files containing sensitive information to an external Google Drive account. Blank Rome later said the incident was limited to one attorney and did not involve a direct breach of its overall network.
How many people were affected and what information was exposed?
Approximately 57,554 people were reported affected by the incident. Potentially involved data included names, Social Security or taxpayer identification numbers, government identification, financial information, medical information, health-insurance information, and other personal details. The exact information differed by person, so an individual’s own breach notice is the best source for understanding what information connected with that person was involved.
Is there a Blank Rome data breach settlement?
Yes, a proposed settlement has been reached in Anthony Santana v. Blank Rome LLP in Florida state court. The agreement creates a $991,508 settlement fund and provides several potential benefits to eligible class members. As of October 31, 2026, the settlement remains subject to final court approval.
What can eligible people receive from the Blank Rome settlement?
Eligible settlement members may claim up to $3,000 in qualifying documented losses related to fraud or identity theft and may also qualify for a pro rata cash payment. The settlement additionally provides one year of credit monitoring without requiring a cash claim for that monitoring benefit. The actual amount of any pro rata payment cannot be determined until valid claims and settlement expenses are known.
What is the claim deadline and what happens if you do nothing?
The current deadline for submitting a cash claim is November 29, 2026, while exclusions and objections are due November 14, 2026. A class member who does nothing will not receive a cash payment but may still receive the available credit-monitoring benefit if the settlement becomes effective. Remaining in the class also generally means you’re bound by the settlement’s releases, so doing nothing differs from formally opting out.
Also Read: Boone Pike Divris Morales: Cases and Legal Meaning Explained
