Greystar Real Estate Partners, LLC, the nation’s largest apartment operator and property manager, has notified individuals that an unauthorized party accessed an employee email account and acquired files that may have contained their personal information. Companies that manage housing for millions of residents nationwide have a responsibility to safeguard the personal information they collect in the course of that business.
Greystar Real Estate Partners, LLC’s Data Breach Investigation
According to a notice filed with the Washington State Attorney General’s Office, Greystar determined that between May 1, 2026, and May 18, 2026, an unauthorized third party accessed an employee email account and acquired certain files stored within it. After identifying the unauthorized activity, Greystar stated that it contained the access, began an investigation with outside cybersecurity specialists, took steps to secure its environment, and notified law enforcement.
Greystar then undertook a review to determine what types of information were contained in the acquired files and to whom that information belonged. Based on that review, the company determined that the acquired files contained affected individuals’ names in combination with certain other personal information. The notification letter Greystar filed does not specify the exact additional data elements involved for any given individual, since the template letter Greystar filed with the state uses a merge-field placeholder that varies depending on what specific information applied to each recipient. Greystar began sending written notice to affected Washington residents on August 27, 2026.
Business email compromise incidents, in which an attacker gains unauthorized access to a company email account rather than breaching a broader network, are among the most common categories of data breach reported to state regulators. A single compromised mailbox can accumulate years of attachments, forms, and correspondence containing tenant applications, lease documents, and other records containing personal information, which is part of why a breach limited to one email account can still affect a meaningful number of people once a full review of its contents is completed.
Property management companies in particular collect and retain large volumes of applicant and resident data, including identification documents, financial information submitted during the leasing process, and communications about maintenance or account issues, much of which can pass through email in the ordinary course of business. When that kind of data is exposed, affected individuals are generally at risk of both general identity theft and more targeted phishing attempts that reference accurate details about their tenancy or account history, since that specificity can make a follow-up scam attempt appear more credible.
Because Greystar operates in nearly every major rental market in the country and manages the personal information of applicants, residents, and former tenants at a national scale, an email compromise at a company of this size can potentially touch individuals across many states even when the underlying incident is limited to a single account. Companies operating at this scale are increasingly expected by state regulators to maintain layered email security controls, such as multi-factor authentication and ongoing employee phishing-awareness training, precisely because a single compromised credential can expose records belonging to a large and geographically dispersed population.
Notification letters that rely on a merge-field placeholder rather than spelling out the exact data elements involved for each individual are a common feature of large-scale breach notifications, since companies often tailor the specific list of exposed information to what was actually found in a given person’s file rather than sending an identical list to everyone. Affected individuals in this situation are generally advised to treat their notice as confirmation that some combination of sensitive personal information was involved, even when the precise data elements are not spelled out in the publicly filed version of the letter, and to take protective steps accordingly rather than assuming the exposure was limited to their name alone.
Greystar has stated that it is providing complimentary credit monitoring and identity restoration services to individuals confirmed to be affected by this incident, and is reviewing its internal policies and procedures to reduce the likelihood of a similar event occurring in the future.
When Did This Breach Occur?
The unauthorized access to the employee email account occurred between May 1, 2026, and May 18, 2026. Greystar began sending written notice to affected Washington residents on August 27, 2026.
What Information Was Breached?
Greystar reported that the acquired files contained each affected individual’s name in combination with certain other personal information not uniformly specified across all recipients in the filed notice. Greystar is providing complimentary credit monitoring and identity restoration services to affected individuals.
What You Can Do
If you received a notice from Greystar Real Estate Partners, consider taking the following steps:
- Enroll in the complimentary credit monitoring and identity restoration services referenced in your notification letter.
- Review your financial account statements and credit reports regularly for unfamiliar activity.
- Place a fraud alert or security freeze on your credit files with Equifax, Experian, and TransUnion.
- Be cautious of any follow-up communications referencing your lease, application, or account with Greystar.
- Report any suspected identity theft or fraud to the Federal Trade Commission and your state attorney general.
File a Data Breach Lawsuit Against Greystar Real Estate Partners, LLC
If you received a notice that your personal information was exposed in the Greystar Real Estate Partners data breach, you may be entitled to compensation. Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
