Almeida Law Group is investigating a data breach at Berkeley Research Group, LLC. If you were affected, contact Almeida Law Group.
About Berkeley Research Group, LLC
Berkeley Research Group, LLC (BRG) is a global management consulting firm founded in 2010 and headquartered in Emeryville, California. The firm provides expert consulting, economic analysis, forensic accounting, corporate finance, disputes and investigations, litigation support, and performance improvement services. BRG serves clients across healthcare, financial services, energy, technology, and legal sectors — including serving as financial advisor in multiple Catholic diocesan bankruptcy proceedings — and operates across approximately 38 locations worldwide with roughly 1,600 employees.
What Happened?
Berkeley Research Group, LLC was listed in a Vermont Attorney General breach report summary dated August 31st, 2026. According to that filing and BRG’s own notifications, the firm suffered a ransomware attack in which an unauthorized actor gained access to its systems between February 28th, 2025, and March 2nd, 2025. BRG confirmed the breach involved Chaos ransomware and that the attacker gained entry by impersonating an internal IT worker on Microsoft Teams to obtain remote access to an employee’s laptop. BRG paid the attacker an undisclosed ransom and received a “destruction log” purporting to confirm deletion of the stolen data, though security experts caution that such assurances from criminal actors cannot be relied upon. The exposed data included names, addresses, dates of birth, Social Security numbers, government ID numbers, financial and bank account information, payment card numbers, usernames and passwords, medical information, and health insurance information. At least 6,083 individuals were notified. BRG is offering 24 months of Kroll identity monitoring to affected individuals.
The timeline of this incident raised significant concerns. BRG discovered the breach on March 2nd, 2025, but did not notify U.S. Trustees until April 28th, 2025, did not report to the U.S. Department of Health and Human Services until April 30th, 2025, and did not begin mailing individual notification letters until October 30th, 2025 — approximately eight months after discovery. BRG’s data review was not completed until March 8th, 2026, more than a year after the incident, with the Vermont Attorney General filing arriving on August 31st, 2026 — over 17 months post-incident. The U.S. Department of Justice separately flagged the breach because it exposed personal data of Catholic clergy sexual abuse survivors from nearly a dozen diocesan bankruptcy cases in which BRG served as financial advisor. Multiple law firms, including ClassAction.org, The Lyon Firm, Console & Associates P.C., Strauss Borrelli PLLC, Srourian Law Firm, and Dapeer Law P.A., have opened class action investigations related to this breach. Aetna disclosed in July 2026 that it was also affected as a BRG client, indicating downstream impact on at least one major insurer and its members.
Key Facts at a Glance
- Company or Organization: Berkeley Research Group, LLC
- Industry: Professional services / Management consulting
- Location: Emeryville, California, USA
- Incident type: Ransomware attack (Chaos ransomware)
- Date of breach: February 28th, 2025
- Date breach discovered: March 2nd, 2025
- Date of consumer notification: October 30th, 2025
- Total persons affected: At least 6,083
- Identity theft protection offered: 24 months of Kroll identity monitoring
- Litigation status: Multiple class action investigations opened; no filed lawsuits confirmed as of latest available information
- Source: Vermont Attorney General breach report summary; BRG Official Notice of Data Incident; Comparitech; DataBreaches.net; ClassAction.org
What Should You Do?
If you received a notification letter from Berkeley Research Group, enroll in the 24 months of Kroll identity monitoring BRG is offering and take note of any enrollment deadline stated in your letter. Regardless of whether you enroll in that program, consider placing a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Review your credit reports for free at AnnualCreditReport.com and watch for unfamiliar accounts or inquiries. Because health records and health insurance information were among the data types exposed, review any Explanation of Benefits statements from your insurer and check your medical records for services you do not recognize. If you see signs of fraud or identity theft, report them at IdentityTheft.gov, which provides a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
