Berkeley Research Group, LLC Data Breach Notice (California Attorney General): What Was Exposed & What To Do

Berkeley Research Group, LLC notified California residents of a data breach in a filing reported to the California Attorney General on August 31, 2026. According to that notice, the underlying incident is dated February 28, 2025. Public detail remains limited: the number of people affected is not stated, and the filing describes the exposed material in general terms as personal information.

For individuals who have dealt with the firm—or whose information may have been held in connection with its work—the disclosure matters because consulting and expert-services organizations routinely handle sensitive personal and professional data. What is confirmed so far is the existence of a notice, the incident date given in the filing, and the broad category of data named. Much else about scope, method, and exact contents has not been made public in the materials summarized here.

Inside the incident

The California Attorney General filing attributes the notice to Berkeley Research Group, LLC and places the incident on February 28, 2025, with the regulatory report dated August 31, 2026. Beyond those dates and the characterization of exposed data as personal information, the public summary does not describe how the incident was discovered, whether systems were accessed remotely or through other means, how long unauthorized access may have lasted, or whether data was exfiltrated, viewed, or otherwise involved.

No figure for the number of affected individuals appears in the available facts. No specific systems, file types, or technical indicators are named. No threat actor is attributed. The gap between the stated incident date and the later filing date is noted in the record but not explained in the summary provided. In short, the confirmed core is a formal breach notification tied to a February 2025 incident and reported in August 2026; operational and forensic particulars remain undisclosed in the material at hand.

How a breach like this happens

Incidents that lead to notices of this kind often follow familiar patterns, though none of those patterns is established as the cause in this specific case. Organizations that store client, employee, or case-related records may see credentials phished or reused, remote access pathways abused, unpatched software exploited, or misconfigured cloud or file-sharing services left exposed. Once an attacker gains a foothold, they may move laterally, locate repositories of personal data, and copy or encrypt material before detection.

Detection can lag weeks or months, especially if logging is incomplete or if the activity blends with normal business traffic. Notification timelines then depend on internal investigation, legal assessment of what constitutes personal information under applicable state law, and coordination with regulators. None of this sequence is documented for the Berkeley Research Group matter in the facts given; it is general background on how similar events typically unfold when personal information is later reported as exposed.

Berkeley Research Group, LLC and its sector

Berkeley Research Group, LLC is known publicly as a professional services firm that provides economic consulting, expert testimony, investigations, and related advisory work. Firms in this sector commonly hold names, contact details, financial and employment histories, litigation or dispute materials, and other records tied to clients, witnesses, employees, and matters under review. That concentration of personal and business-sensitive information makes such organizations attractive targets and raises the stakes when a breach notice is issued.

A compromise at a research and consulting firm can affect not only direct employees but also individuals whose data appears in case files, due-diligence packages, or administrative systems. The consequential nature of a breach here stems from the trust placed in the firm to handle confidential material and from the potential downstream use of any personal information that may have been involved. The filing itself does not detail which of the firm’s practices or systems were implicated.

What data was at risk

The breach notification, as summarized, names personal information as the category of data exposed. It does not itemize fields such as Social Security numbers, financial account details, driver’s license numbers, health data, or other specific elements. Because the exact contents are unconfirmed in the public facts, it is not possible to state which precise data elements were involved.

Organizations of this type typically maintain identity and contact data, professional and educational backgrounds, billing and payment information, and documents related to engagements. Any of those categories could, in principle, fall under a broad label of personal information. Readers should treat the named category as the only confirmed description and regard more granular lists as unverified unless and until the firm or regulators publish them.

Why it matters

When personal information is exposed, affected people face practical risks that can include targeted phishing, account takeover attempts, identity fraud, and unwanted contact that leverages details that appear legitimate because they came from a trusted professional context. Even without confirmation of high-sensitivity fields, basic identity and contact data can be combined with other leaked sets to build convincing social-engineering attacks.

For the organization, a breach notice carries regulatory, contractual, and reputational consequences. Clients and counterparties may reassess data-handling practices; individuals may need to monitor credit and accounts; and the firm may face ongoing notification, support, and remediation obligations. The absence of a published count of affected people does not reduce the need for caution among anyone who has reason to believe their information was held by the firm around the time of the incident.

Were you affected?

If you have been a client, employee, contractor, or otherwise connected to Berkeley Research Group, LLC, treat the notice as a prompt to verify your own exposure. Review any direct communication from the firm for guidance it may offer, place fraud alerts or credit freezes if appropriate for your situation, and watch for unexpected account activity or highly tailored phishing. Change passwords on related accounts, especially if you reused credentials, and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets. Doing so does not confirm or rule out involvement in this specific incident, but it can help you prioritize further monitoring and protective steps while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.