The Gettys Group Data Breach — Class Action Review

The Gettys Group is a prominent hospitality design, branding, and development firm that works with major hotel brands, real estate developers, and commercial property owners across the globe. Because of its comprehensive role in managing hotel interiors, architectural planning, procurement, and asset management, the company operates at the intersection of corporate enterprise and high-end hospitality. To facilitate large-scale commercial projects, manage global supply chains, and maintain client relationships, The Gettys Group routinely collects, processes, and stores a vast repository of sensitive information. This includes detailed corporate records, internal financial documents, proprietary project specifications, and extensive employee and contractor personally identifiable information necessary for global payroll, human resources administration, and vendor management.

In 2025, The Gettys Group reported a significant data security incident to the Indiana Attorney General, alerting affected individuals and regulatory authorities that their digital systems had been compromised. While the exact vector of the attack remains part of the ongoing investigation, security incidents affecting sophisticated design and consulting firms typically involve unauthorized access to corporate networks, ransomware deployment, or vulnerabilities within third-party vendor systems. In the architecture and hospitality design sector, cybercriminals frequently target enterprise networks to exfiltrate valuable intellectual property, corporate financial records, and accumulated personnel data stored across centralized human resources databases and remote server environments.

The exposure of personal and corporate data in a breach of this magnitude carries severe risks for affected individuals. Because organizations like The Gettys Group process sensitive employment and financial records, compromised data sets frequently include full legal names, Social Security numbers, dates of birth, home addresses, banking details, and tax documentation. When Social Security numbers and dates of birth fall into the hands of malicious actors, victims face an immediate and lifelong risk of identity theft, fraudulent credit card applications, unauthorized loans, and tax return fraud. Furthermore, the compromise of direct deposit information and corporate banking credentials exposes individuals to direct financial account takeover and fraudulent wire activity.

Under applicable state data protection statutes, including the Indiana Disclosure of Security Breach Law, businesses operating within the state have an affirmative legal duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information they hold. This statutory obligation requires companies to secure their networks against foreseeable cyber threats, encrypt sensitive files, and monitor for unauthorized access. The occurrence of a data breach resulting in the exposure of unencrypted sensitive data serves as a strong indicator that the organization may have failed to meet these rigorous security standards, potentially constituting a breach of common law negligence and statutory compliance.

Receiving an official data breach notification letter from The Gettys Group is a formal acknowledgment that your private information was compromised due to corporate security failures. Legally, this notice establishes the foundation and standing necessary to participate in a class action lawsuit aimed at holding the company accountable for its inadequate data protection practices. Importantly, victims do not need to prove that they have already suffered actual financial loss to seek legal recourse; the increased risk of future identity theft and the time required to mitigate those risks are recognized harms. Our firm investigates these matters on a contingency fee basis, meaning you pay no out-of-pocket costs or attorney fees unless we successfully recover compensation on your behalf.