GrayRobinson data breach: a Florida law firm's files, and health data it held for clients

Why would a law firm send me a breach letter?

GrayRobinson filed with HHS as a business associate, the filer type for organizations that handle health information for HIPAA-covered clients. Its HHS figure, 54,131, is lower than Indiana's total of 80,383, and neither record explains the difference. The guide to breach letters from companies you never dealt with explains how this happens, and the guide to law firm breach notices compares three other firms' letters.

What happened at GrayRobinson?

The firm says it secured its network, reported the incident to law enforcement and investigated with outside cybersecurity professionals. Its review of the affected data ended on April 13, 2026, more than a year after detection.

Date	What the letter and the regulators' records say
March 5 to 24, 2025	Files may have been accessed or removed
On or about March 24, 2025	Unauthorized access detected
April 13, 2026	Review finds personal information in the files
April 24, 2026	Report to HHS (54,131, as a business associate); Indiana notice (80,383 total; 234 in Indiana); logged in Massachusetts (107 residents); notice recorded by California

For the 107 Massachusetts residents in GrayRobinson's notice, the state's record marks Social Security numbers, medical records, financial accounts and driver's licenses as breached.

What is GrayRobinson offering?

Item	Detail from the letter
Service	Experian IdentityWorks, for the number of months printed on each letter
Questions	A call center number printed on each letter, open for 90 days from the letter date, 9:00 a.m. to 6:30 p.m. Eastern Time, Monday to Friday, excluding holidays

The firm says it has no evidence that anyone's information has been used for financial fraud or identity theft. The guide to credit monitoring offers sets GrayRobinson's offer beside other letters.

What Texas's attorney general recorded

Texas's attorney general lists a report from GrayRobinson, P.A., posted on May 5, 2026, with 578 Texans affected, a count of Texas residents only. The record lists names, addresses, Social Security numbers, driver's license numbers, financial account or card information, medical information, health insurance information and dates of birth as involved.

What the documents leave open

• Which clients' files were involved.
• How the intruder got in.
• Why the HHS and Indiana totals differ.

With 54,131 people, GrayRobinson's report is the 72nd largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.