Blank Rome Sued Over Breach Exposing Data of Over 57,000 People

Blank Rome LLP was hit with two proposed class actions Monday alleging it negligently failed to protect the personal information of more than 57,000 current and former clients in a May data incident.

The firm breached its duties under common law, contract law, industry standards, the Federal Trade Commission Act, and the Health Insurance Portability and Accountability Act to implement reasonable and adequate data security measures and provide timely notice of the breach, according to complaints filed in the US District Court for the Eastern District of Pennsylvania.

Laura Delapaz and Anthony Santana alleged in the separate lawsuits that the breach exposed names, Social Security numbers, physical and email addresses, phone numbers, dates of birth, taxpayer identification numbers, driver’s license numbers, state ID card numbers, passport numbers, financial-account numbers, payment card information, medical information, and health insurance information.

Blank Rome, an Am Law 100 firm with 800 attorneys in 16 offices in the US and abroad, said in a statement that the breach occurred when a cybercriminal posing as the firm’s IT department misled an attorney into uploading files to an external file-hosting website. There was no access to the firm’s network or disruption of operations, it said.

“We believe the lawsuit has no merit and will aggressively defend against it,” it said.

Other law firms that have been sued over data breaches include Washington-based Wiley Rein LLP ; New York-based Fried, Frank, Harris, Shriver & Jacobson LLP ; and Texas-based Pillsbury Winthrop Shaw Pittman LLP .

Class members suffered injuries including invasion of privacy, lost time and out-of-pocket expenses responding to the breach, emotional distress, increased spam communications, reduced value of personal information, and increased risk of fraud and identity theft, the complaints said.

Delapaz and Santana each seek to represent a class of people in the US whose private information was compromised in the breach.

The nearly identical complaints bring claims of negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, breach of confidence, and violations of the California Unfair Competition Law, the California Consumer Privacy Act, and the California Customer Records Act.

The plaintiffs are seeking compensatory, punitive, and statutory damages; restitution; equitable and injunctive relief; attorneys’ fees and costs; and pre- and post-judgment interest.

Strauss Borrelli PLLC represents Delapaz. KO Lawyers, Milberg PLLC, and Srourian Law Firm PC represent Santana.

The cases are Delapaz v. Blank Rome LLP , E.D. Pa., No. 2:26-cv-04655, complaint filed 7/6/26, and Santana v. Blank Rome LLP , E.D. Pa., No. 2:26-cv-04661, complaint filed 7/6/26.

Bloomberg Law provides trusted coverage of current events enhanced with legal analysis.

Log in to keep reading or access research tools and resources.