Grant Street Group, LLC has sent a notice about a data security incident involving a former third-party service provider, the law firm Blank Rome LLP. This page summarizes what the notice and the Massachusetts breach report say so far.
Grant Street Group’s Data Breach Investigation
Grant Street Group, LLC, which the Massachusetts breach report classifies as a technology company, has notified people that their personal information was part of a data security incident at a former third-party service provider, the law firm Blank Rome LLP. The notice letter, dated October 9, 2026, was sent by an outside law firm on behalf of Grant Street, and a sample was filed with the Massachusetts Office of Consumer Affairs and Business Regulation and posted on the state’s website.
According to the letter, on May 21, 2026, an attorney at Blank Rome was misled into uploading certain files to an external Google Drive folder during a social engineering attack. Social engineering means tricking a person, rather than breaking into software, and it is a common way for attackers to obtain files from professional firms. The letter says the compromised device was taken offline within several hours and the files were deleted from the external folder. Blank Rome then began an internal investigation with third-party cybersecurity professionals and notified law enforcement.
The timeline in the notice has a long gap in it. Grant Street says it was informed of the incident on September 11, 2026, almost four months after the files were uploaded, and that it then reviewed the affected files itself. The letter to individuals is dated October 9, 2026, and the matter was reported to Massachusetts on October 20, 2026, according to the state’s breach report. The notice does not explain why Grant Street was told in September rather than May, a question that regulators and attorneys often ask in outsourced-vendor incidents.
The letter says certain of the affected files contained personal information, including a W-9 form. A W-9 is the tax form that individuals and businesses give to a company that pays them, and it contains a name, address, taxpayer identification number and signature. Here the letter says the form included the person’s name, Social Security number, address and signature. It adds that, to Grant Street’s knowledge, no other sensitive personal or financial information of the recipient was compromised.
The Massachusetts report shows 1 Massachusetts resident affected, and flags Social Security numbers and financial account information as breached. No total number of affected people has been published. The notice does not say how many Grant Street contacts had forms in the files, or whether people in other states were notified. Because a W-9 is usually collected from vendors, contractors and other payees, the people affected may be individuals who did business with the company rather than ordinary customers.
The letter describes steps taken since the incident. Grant Street says it will continue to cooperate with law enforcement and forensic investigators, and that people will be told if there are further significant developments. It also says its understanding is that the attorney involved in the incident has been fired, and that Grant Street has ended its service relationship with Blank Rome. To help protect people, it is offering two years of credit monitoring free of charge through Epiq’s Privacy Solutions ID service, and the letter recommends that anyone who has not already enrolled do so as soon as possible.
The letter also recommends that people closely monitor their financial accounts, report unauthorized activity to their financial institution, and consider reporting identity theft to the Federal Trade Commission. It suggests requesting a free credit report from each of the three national credit bureaus, and points to the bureaus for fraud alerts and security freezes. Questions can be directed to the attorney named in the letter.
A name, Social Security number, address and signature together are enough to support serious fraud. They can be used to open credit accounts, file false tax returns, or forge documents, and a signature adds a layer of risk that most data breaches do not carry. Incidents at professional service providers also illustrate how a company’s exposure can extend beyond its own systems to the vendors it hires. If you received a letter from Grant Street Group, keep it and consider freezing your credit. Attorneys are looking into whether Grant Street and its vendor took reasonable steps to protect the information they held.
When Did This Breach Occur?
The notice says the social engineering attack on Blank Rome happened on May 21, 2026, and that Grant Street was informed of it on September 11, 2026. The letter to individuals is dated October 9, 2026, and the filing was reported to Massachusetts on October 20, 2026. The notice does not say how long the files were exposed in the external folder beyond stating that they were deleted within several hours.
What Information Was Breached?
The notice says the affected files included a W-9 form containing a person’s name, Social Security number, address and signature. It says that, to Grant Street’s knowledge, no other sensitive personal or financial information of the recipient was compromised. The Massachusetts breach report flags Social Security numbers and financial account information as breached. Not every person will have had the same data involved, so your own letter is the best guide to what applies to you.
What You Can Do
If you received a notice related to Grant Street Group or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the two years of Epiq Privacy Solutions ID credit monitoring offered in the letter if you have not already done so.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Grant Street Group
If you received a notice from Grant Street Group, or you believe your information was involved, you may have legal options for holding the company, and any vendor responsible, accountable for how your Social Security number, signature and other sensitive information were protected.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
