Berkeley Research Group Data Breach Lawsuit Investigation
Received an August 2026 breach notice from Berkeley Research Group?
Dapeer Law, P.A. is investigating a potential class action against Berkeley Research Group, LLC, an expert services and consulting firm headquartered in Emeryville, California, on behalf of individuals whose Social Security numbers, government identification numbers, financial account information, and medical or health insurance information may have been copied from the firm's network in the February and March 2025 cyber incident disclosed in notice letters dated August 31, 2026.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from Berkeley Research Group dated August 2026.
- Your letter offered enrollment in 24 months of complimentary identity monitoring through Kroll, including credit monitoring, fraud consultation, and identity theft restoration, with a membership number and an activation deadline printed in the letter.
- You had personal, financial, or health information held by Berkeley Research Group, in many cases because the firm received records about you while performing consulting, expert, or litigation support work for one of its clients.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
Berkeley Research Group detected suspicious activity on its network on Sunday, March 2, 2025, according to the notice the firm filed with the California Attorney General. A forensic investigation supported by outside cybersecurity specialists concluded that an unauthorized actor gained access to the environment beginning on the evening of February 28, 2025 and that the access ended on March 2, 2025. During that window, the investigation determined that certain files containing personal information were copied out of the firm's systems. Berkeley Research Group notified federal law enforcement and additional authorities, and states that it has documented full containment with no further alerts since its response began.
The notice describes a broad set of data elements that may have been involved, including name and address, Social Security number, date of birth, driver's license or state identification number, passport or other government-issued identification number, credit or debit card number and other financial account information, and health insurance and medical information. The company is offering 24 months of complimentary identity monitoring through Kroll, which includes credit monitoring, fraud consultation, and identity theft restoration support, with enrollment at enroll.krollmonitoring.com using the activation code printed in each letter. The filing made with Texas regulators reports 92,290 individuals. Letters carrying an August 31, 2026 date began going out roughly 18 months after the intrusion was discovered.
Berkeley Research Group is an expert services and consulting firm rather than a consumer-facing business, and it receives personal records from corporate, institutional, and government clients in order to perform litigation support, data analysis, and advisory work. Many people who received a letter may never have had a direct relationship with the firm and may not recognize the name. That structure is central to our investigation. Where a professional services vendor holds Social Security numbers alongside medical and health insurance information, we look at what safeguards, encryption, access controls, and retention limits applied to client data the firm was never obligated to keep indefinitely, what its client contracts required, and whether the roughly 18-month gap between discovery and notification satisfied the notification deadlines set by California, Texas, and other state breach notification statutes.
What to do if you received a letter
Keep your notice letter
Do not discard your Berkeley Research Group notice letter. The letter contains your Kroll activation code, the enrollment deadline, and the list of information categories involved in your individual case, all of which are important evidence if you decide to participate in a lawsuit. If you do not recognize the company, keep the letter anyway, since the firm may have held records about you through work it performed for an employer, health plan, insurer, or other organization.
Enroll in the free 24-month Kroll identity monitoring
Enroll in the 24 months of Kroll identity monitoring offered in your letter before the activation deadline printed there, using the code Berkeley Research Group provided. Enrollment is available at enroll.krollmonitoring.com, and the coverage includes credit monitoring, fraud consultation, and identity theft restoration. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. Because Social Security numbers, passport numbers, and driver's license numbers may have been involved, place a free security freeze with Equifax, Experian, and TransUnion, order your free credit reports at AnnualCreditReport.com, and consider requesting an Identity Protection PIN from the IRS to guard against fraudulent tax filings. Because payment card and financial account information may also have been involved, review your card and bank statements for unfamiliar charges and ask your bank about reissuing affected cards. Because health insurance and medical information may have been involved, review the explanation of benefits statements from your health plan for services you did not receive.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your Berkeley Research Group notice, explain your options, and advise whether you may be eligible to pursue claims under California, Texas, or other state data breach and consumer protection laws.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, fraudulent accounts or loans opened in your name, fraudulent charges on existing cards and bank accounts, fraudulent tax filings, passport and driver's license fraud, medical identity theft and fraudulent billing, credit freeze and restoration costs, and the time you spent responding to the incident, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring Berkeley Research Group to implement stronger safeguards over the client-supplied personal, financial, and health information it holds, including encryption at rest, tighter access controls and network segmentation, enforced retention limits so records are deleted when an engagement ends, and prompt notification of affected individuals in the event of a future incident.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from Berkeley Research Group. What should I do? +
Keep your Berkeley Research Group notice letter and the Kroll activation code it contains, enroll in the 24 months of complimentary identity monitoring before the deadline printed in your letter, place a free security freeze with Equifax, Experian, and TransUnion, order your free credit reports at AnnualCreditReport.com, review your bank, card, insurance, and medical statements for unfamiliar activity, consider requesting an Identity Protection PIN from the IRS, document any time or money you spend responding to the incident, and consider speaking with a data breach attorney. If you experience identity theft, report it to the FTC at ftc.gov/idtheft or (877) 438-4338 and file a police report, keeping a copy for your records.
Am I eligible to join a class action against Berkeley Research Group? +
Individuals who received a Berkeley Research Group notice letter dated August 31, 2026 are the most direct candidates. Eligibility for any legal claim will also depend on your state of residence, the categories of your information that were involved, and any documented losses or out-of-pocket expenses. Because the notice describes Social Security numbers, government identification numbers, financial account information, and medical and health insurance information, recipients may have stronger claims than in incidents limited to names and contact details. A free case review can help you understand your options.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
According to the notice filed with the California Attorney General, the information that may have been involved includes name and address, Social Security number, date of birth, driver's license or state identification number, passport or other government-issued identification number, credit or debit card number and other financial information, health insurance and medical information, and other information contained in the affected files. Not every recipient's letter will list every category. Your individual letter is the most reliable source for exactly what was involved in your case, so we recommend reviewing it carefully and saving a copy.
Did Berkeley Research Group offer free credit monitoring? +
Yes. Berkeley Research Group engaged Kroll to provide 24 months of complimentary identity monitoring, which the notice describes as including credit monitoring, fraud consultation, and identity theft restoration support. Enrollment is at enroll.krollmonitoring.com using the activation code printed in your letter, and the activation deadline appears in the letter rather than in the public filing. Enrolling does not waive your right to pursue legal action.
How many people were affected by the Berkeley Research Group breach? +
The filing made with Texas regulators reports 92,290 individuals. Berkeley Research Group has not published a separate nationwide figure, and because the firm holds records supplied by many different clients, notification has reportedly gone out in more than one round. This page will be updated if additional information becomes available.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
Berkeley Research Group filed the sample notice letter with the California Attorney General, and the PDF can be downloaded from the link in the Sources & References section below. The firm has also posted a notice of data incident on its own website. If you cannot locate your individual letter, Dapeer Law can help you obtain a copy as part of a free consultation.
Sources & references
- Official breach notice filing · California Attorney General, Berkeley Research Group Sample Notice Letter (PDF)
- Company notice · Berkeley Research Group, Notice of Data Incident
- Identity monitoring enrollment · Kroll, enroll.krollmonitoring.com
- Company · Berkeley Research Group, LLC (thinkbrg.com)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
