Greenbaum Rowe Smith & Davis LLP reported a cybersecurity incident that occurred between November 25 and November 27, 2025. The incident was discovered on November 27, 2025, and a public breach listing appeared on May 18, 2026. The firm sent notices on June 8, 2026. The reported incident involved information connected to patients of healthcare provider clients.
Information that may have been involved included names, addresses, medical and health insurance information, and, for some individuals, Social Security numbers and dates of birth. The health-related information may have included medical record numbers, account numbers, diagnoses, clinical information, medical histories, treatment or procedure information, healthcare providers, dates of service, medical costs, and health insurance information. A public filing listed 12,801 potentially affected individuals. The available sources do not identify affected states or report a separate vendor-wide incident total. Further details may be disclosed as notices and filings are updated.