Berkeley Research Group, LLC Data Breach Notice (California Attorney General)

The personal information of an unknown number of California residents was exposed in a breach at Berkeley Research Group, LLC that occurred on February 28, 2025. The organisation filed its notification with the California Attorney General on August 31, 2026 — an interval of 549 days, or roughly 18 months.

That long gap between the incident and the formal filing is the most striking fact in the record. While notification timelines vary by state and depend on when an investigation concludes, the delay is substantial enough to matter to anyone whose records may have been involved.

Your Information Is Now Harder to Keep Private

The filing lists personal information as exposed. Because the record does not break this down into specific fields for each person, your own notification letter is the only document that can tell you exactly what was included in your case. If you received a letter from Berkeley Research Group, read it carefully. Absence of a letter usually means you were not in the affected group, but anyone who has moved since February 28, 2025 should contact the organisation directly to confirm their status.

What Personal Information Exposure Actually Enables

Names combined with other personal details remain valuable to identity thieves years after a breach. This information can be used to file fraudulent tax returns, open accounts in your name, or impersonate you when dealing with government agencies, insurers, or creditors. Unlike a credit card number that can be cancelled, personal information cannot be reissued.

No passwords were exposed. The record contains no credential fields, so there is no need to change any password for Berkeley Research Group itself. That is genuinely good news in a breach notification and removes one common source of immediate worry.

The Long-Term Reality of This Exposure

Once personal information leaves an organisation’s control, it can circulate indefinitely. Criminal networks buy and sell such data on underground markets, often reusing it in multiple fraud schemes over time. The 18-month delay between the February 2025 incident and the August 2026 filing means the information may already have been available to attackers for well over a year before most people learned about it.

The filing does not disclose the exact initial access vector, whether the data was copied or simply viewed, or any further technical details. It also does not state how many people were affected. These omissions are common in breach notifications but leave affected individuals with more questions than answers.

Why the 549-Day Interval Stands Out

Most states require organisations to notify affected residents “without unreasonable delay.” A gap of nearly a year and a half is long by any standard. While the record does not explain the reasons for the delay and we cannot assume negligence, the practical effect is the same: many people have spent more than a year carrying potential exposure without knowing it.

Berkeley Research Group also filed similar notices in Oregon, South Carolina, and Vermont, confirming the incident was not limited to California residents.

What You Can Still Control

You cannot make the exposed personal information disappear, but you can reduce what criminals can do with it. Monitoring your credit reports, tax filings, and explanation of benefits statements gives you the best chance of catching misuse early. Freezing your credit with the three major bureaus remains one of the strongest preventive steps available when Social Security numbers or other identity data are involved, even though the exact fields are not detailed beyond the generic “personal information” category.

Place a fraud alert if you have not already done so. Review your annual tax transcript from the IRS each year. Consider identity theft protection services that include dark-web monitoring for your specific information. These steps do not undo the breach but limit the damage that can follow from it.

The letter from Berkeley Research Group is the definitive answer on whether you were affected. If you have moved since the incident date of February 28, 2025, do not rely solely on the absence of mail. Contact the organisation to verify your status. For everyone else, treat this filing as a permanent reminder that your personal information now exists in more places than you control, and adjust your vigilance accordingly.