Jones Lang LaSalle Americas, Inc. data breach

What we know

Jones Lang LaSalle Americas, Inc. (JLL) operates as a prominent global commercial real estate and investment management firm, delivering comprehensive property services, corporate facilities management, and transactional advisory solutions to major corporate tenants, property owners, and institutional investors. Because of its expansive role in managing large-scale commercial portfolios, corporate workplaces, and real estate transactions, JLL routinely collects, processes, and stores vast quantities of highly sensitive data. This includes exhaustive employee records, personnel files, contractor credentials, and proprietary financial documents necessary for corporate human resources, payroll administration, and nationwide property operations. In 2025, Jones Lang LaSalle Americas, Inc. formally reported a significant data security incident to the Office of the Massachusetts Attorney General, raising serious concerns regarding the safety of confidential consumer and employee information. While the exact vector of the breach remains subject to ongoing forensic investigation, cyberattacks targeting major corporate service providers typically involve sophisticated unauthorized intrusions into enterprise databases, credential stuffing schemes, vulnerabilities within third-party vendor networks, or targeted malware and ransomware deployments. Given the interconnected nature of modern commercial real estate operations, an intrusion into JLL's digital infrastructure can expose centralized repositories containing confidential corporate and personal records. The data compromised in incidents of this magnitude frequently includes full legal names, Social Security numbers, dates of birth, home addresses, banking details, wage and compensation figures, and internal tax documentation. The exposure of this specific combination of personally identifiable information creates profound, long-term risks for affected individuals. Social Security numbers and dates of birth serve as the permanent keys to identity theft, enabling malicious actors to open fraudulent lines of credit, apply for unauthorized loans, or intercept government tax refunds. Furthermore, the compromise of direct deposit and payroll details exposes victims to immediate financial account takeover, unauthorized wire transfers, and sustained exposure to targeted phishing and social engineering campaigns. As a corporate entity handling sensitive employment and financial data, Jones Lang LaSalle Americas, Inc. was legally obligated to implement and maintain robust, industry-standard cybersecurity safeguards to protect this information from unauthorized disclosure. Under the Massachusetts Data Privacy Act and applicable state consumer protection laws, companies operating within the commonwealth must adopt comprehensive administrative, physical, and technical safeguards, including strict encryption standards, multi-factor authentication, network segmentation, and regular security audits. The occurrence of a widespread data breach strongly suggests potential failures in these mandatory security protocols, indicating that vulnerabilities in JLL's network defenses were left unmitigated, thereby breaching the implicit duty of care owed to employees and consumers. Receiving an official data breach notification letter from Jones Lang LaSalle Americas, Inc. serves as formal legal recognition that your sensitive personal information was compromised due to inadequate corporate security. Under modern legal standards, the receipt of such a notification establishes the necessary legal standing to participate in a class action lawsuit, without requiring immediate proof of actual financial loss or identity theft. Our law firm is actively investigating potential claims against JLL on behalf of affected individuals. We handle all data breach class action cases on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only recover fees if we successfully secure a financial recovery on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.