Levin Sedran & Berman data breach letter: files taken in October 2025, notices sent 13 months later

Date	Event
October 7, 2025	Suspicious activity identified on the firm's network; investigation begins
October 5, 2026	The firm finishes identifying contact details for the people involved
November 10, 2026	Date on the letters
November 12, 2026	Notice posted by the California attorney general and logged in Massachusetts and Vermont

What happened at Levin Sedran & Berman?

The firm says the investigation, run with cybersecurity experts, found that some of its files may have been accessed or acquired without authorization. It then reviewed the affected files, learned that certain people's information was in them, and searched for addresses so it could write to them. That work ended on October 5, 2026. The letter does not say how the intruder got in, whether ransomware was used, or how many people are being notified.

Why would a law firm hold my information?

The firm describes itself as a leader in high-profile class action and mass tort cases. The letter does not say whose files were affected or in which matters. Why you got a breach letter from a company you never dealt with explains how that happens, and law firm breach notices covers other firms in the log.

What information was involved?

The sample letter filed in California lists the person's name and leaves the rest as a blank field, filled in per letter. The state records give more. Massachusetts marks Social Security numbers, financial accounts and driver's licenses as involved, and medical records and card numbers as not involved. Vermont lists Social Security numbers, government ID numbers and health records. The two state records do not agree on health information, and the letter does not settle it; your own letter names what applies to you.

Record	Residents	Information listed
Massachusetts, report 2026-1991	243	SSN, financial account, driver's license
Vermont, November 12, 2026	59	SSN, government ID numbers, health records

Has the information been misused?

The firm says it has no evidence that anyone's information has been misused for identity theft or fraud. It says it has added measures to harden its environment, without naming them.

What is the firm offering, and by when must I enroll?

Free Experian IdentityWorks membership, with a credit report at sign-up, credit monitoring, identity restoration and up to $1 million in identity theft insurance. The sample letter leaves the number of months blank. The enrollment deadline is January 31, 2027, at 11:59 pm UTC. Questions go to 833-931-5437, Monday through Friday, 9:00 am to 9:00 pm Eastern. Credit monitoring offers in breach letters compares this offer with others in the log.

Why did the notice take more than a year?

The letter gives the order of events, not a reason for the timing: about a year of file review, then an address search that ended on October 5, 2026, then letters dated November 10. In this log, state breach notices from legal and professional services firms take a median of 148 days from discovery to disclosure (18 entries); this one took 401. The sector table shows the medians for every sector.