Legal Services of Long Island data breach: 94,434 current and former clients' data taken

What happened at Legal Services of Long Island?

The organization's website notice sets out four dates. On or around November 23, 2025 it found suspicious activity in its systems and brought in cybersecurity and forensic specialists. On January 5, 2026 those specialists recovered the files an unauthorized third party had accessed and began reviewing them. On May 15, 2026 the investigation found that the third party had accessed certain systems and removed data. On June 1, 2026 notice went to the people potentially affected. The notice does not say how the intruder got in or whether it was ransomware.

Date	What happened	Source
On or around November 23, 2025	Suspicious activity found; specialists engaged	LSLI notice; Indiana report
January 5, 2026	Forensic team recovers and starts reviewing the accessed files	LSLI notice
May 15, 2026	Investigation finds data was removed	LSLI notice
June 1, 2026	Notice to potentially affected people	LSLI notice; Indiana report
December 2, 2026	End of the IDX enrollment period	LSLI notice

The notice went out 190 days after the first sign of trouble. The notice-delay guide shows how that compares.

Whose data was in the Legal Services of Long Island breach?

Current and former clients. The notice says the organization received their personal information as part of the services it provides: help resolving housing issues and getting government benefits, plus outreach and community education. The notice is a substitute notice, posted on the organization's website out of what it calls an abundance of caution and in line with applicable law.

What information was exposed?

The notice lists address, date of birth, Social Security number, and personal health information such as diagnosis, treatment and the name of the doctor or medical professional. It says there is no evidence so far that anyone's information was misused.

How many people were affected?

94,434 in total, per Indiana's 2026 report, including 27 Indiana residents. The organization's own notice gives no count. The largest data breaches of 2026 shows where it sits among this year's notices.

Can I still sign up for the free credit monitoring?

Yes, until December 2, 2026. The IDX package includes 12 months of credit monitoring, a $1,000,000 insurance reimbursement policy and CyberScan dark web monitoring, at no charge. Enrollment is at response.idx.us/legalservicesli, and IDX answers questions at 1-855-759-9333. The notice names a contact at the organization for other questions, on (631) 232-2400 extension 3018. It also points to the New York State Division of Consumer Protection, (800) 697-1220, for advice on identity theft. A free credit freeze with the three bureaus is open to anyone and does not depend on the offer; the guide to credit monitoring offers explains the difference.

What the record leaves open

• How the intruder got in, and whether files were encrypted.
• Why it took from January 5 to May 15, 2026 to confirm that data had been removed.
• How many of the 94,434 had health information in the files.