On or about March 24, 2025, GrayRobinson, P.A. (“GrayRobinson”), a Florida-based law firm, became aware of unauthorized access to its computer network. According to the Notice of Data Event, GrayRobinson promptly took steps to secure its systems, reported the incident to law enforcement, initiated an internal investigation, and engaged external cybersecurity professionals to assess the scope of the incident.
Following its investigation, GrayRobinson determined that certain files may have been accessed or removed without authorization between March 5, 2025, and March 24, 2025. Due to the time required to review the affected data and identify impacted individuals, it was not until April 13, 2026, that GrayRobinson concluded the impacted files may have contained personal information and that there was sufficient information to issue direct notification letters.
After confirming the nature of the incident, GrayRobinson worked to resecure its network environment and continued implementing additional safeguards designed to strengthen system security and reduce the risk of similar incidents in the future.
GrayRobinson, P.A. is a full-service law firm with offices throughout Florida and Washington, D.C., providing legal services across a wide range of practice areas, including employment, healthcare, real estate, litigation, and government affairs.
At the time of notification, GrayRobinson reported that it had no evidence that the affected information had been used for identity theft or financial fraud. However, the investigation confirmed that unauthorized access to files containing personal information may have occurred.
Individuals whose information may have been involved began receiving written notification letters in April 2026. If you received a Notice of Data Event from GrayRobinson, it indicates that your personal information may have been impacted by this cybersecurity incident.
As part of its response, GrayRobinson is offering affected individuals complimentary Experian IdentityWorks credit monitoring and identity restoration services for a specified period, provided enrollment is completed by the deadline listed in the notification letter.
What information is involved in the GrayRobinson, P.A. Data Breach?
Compromised information may include:
First Name
Last Name
Other Personally Identifiable Information
The specific data elements involved vary by person and are outlined in each individualized notification letter issued by GrayRobinson.
Personally Identifiable Information (PII) includes information that can be used to identify an individual, such as a name combined with other personal details. Organizations that maintain sensitive client data—including law firms—have a legal obligation to protect this information. When PII is exposed during a data breach, it may be exploited by cybercriminals to commit identity theft, financial fraud, or other forms of misuse.
Depending on the circumstances, some individuals’ information may also qualify as sensitive financial or professional data. When such information is compromised, it can be used for fraudulent transactions, account takeovers, or other improper activities.
If your information was involved in this incident, it is important to remain alert. Affected individuals are encouraged to closely monitor financial accounts and credit reports for suspicious activity and to carefully review the guidance included in the GrayRobinson notification letter. Recommended protective steps may include enrolling in credit monitoring services, placing fraud alerts or credit freezes, and reviewing free annual credit reports.
Consumers may have legal rights when a law firm or other organization fails to adequately safeguard personal information. These rights vary by state and depend on the type of information exposed and the details of the incident.
If you received a Notice of Data Event / Notice of Data Breach related to GrayRobinson, P.A., your personal information may be at risk.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.