The John Buck Company (“Tjbc”) data breach

What we know

The John Buck Company is a prominent, full-service real estate development, investment, and property management firm headquartered in Chicago, Illinois. Operating in major metropolitan markets, the company oversees high-profile commercial and residential properties, handling large-scale development projects, asset management, and tenant leasing operations. Because of the multi-faceted nature of its business, The John Buck Company routinely collects, processes, and stores vast quantities of highly sensitive personal and financial data. This includes comprehensive records for current and former employees, tenant background files, vendor payment details, investor banking credentials, and private lease agreements containing confidential personal identifiers. In 2025, The John Buck Company reported a significant cybersecurity incident to the Illinois Attorney General, joining a growing number of corporate real estate and property management firms targeted by sophisticated threat actors. While the precise mechanics of the breach continue to be scrutinized, security incidents of this nature typically involve unauthorized intrusions into corporate networks, credential harvesting, or ransomware deployments targeting centralized database repositories. Real estate and asset management firms are increasingly attractive targets for cybercriminals because their operations require the constant exchange of wire instructions, high-value financial transactions, and extensive personally identifiable information across disparate vendor and partner networks. The exposure resulting from this breach compromises a dangerous cross-section of personal data, including individuals' full names, Social Security numbers, dates of birth, banking details, and tax documentation. The compromise of Social Security numbers and financial account information creates immediate, long-term risks for victims, opening the door to sophisticated identity theft, tax fraud, unauthorized credit applications, and direct financial account takeover. When sensitive employee and tenant records are leaked, victims face years of heightened vulnerability, requiring constant monitoring of credit reports, bank statements, and tax filings to mitigate ongoing fraud risks. Under Illinois state data protection statutes, as well as common law standards of corporate duty, The John Buck Company had a strict legal obligation to implement and maintain robust administrative, technical, and physical safeguards to protect sensitive personal information from unauthorized access. Companies that collect and retain valuable private data are legally required to adhere to industry-standard cybersecurity frameworks, perform regular vulnerability assessments, and encrypt stored records. A data breach of this scale strongly indicates a failure in these foundational security duties, suggesting that vulnerabilities in the company's network architecture or access controls were left unaddressed. Receiving an official data breach notification letter from The John Buck Company is a formal acknowledgement that your private information was compromised due to corporate security shortcomings. Legally, the receipt of this notice establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the company accountable. Affected individuals do not need to wait until financial fraud actually occurs to seek legal recourse; the increased risk of identity theft and the time required to mitigate it are recognized harms. Our firm is actively investigating claims on a contingency fee basis, meaning there are no out-of-pocket costs or fees unless we successfully recover compensation on your behalf.

See every breach reported in Illinois or read what to do after a ransomware attack.