Summary
- Environment: Law-firm network and stored personal information
- Operational impact: Network disruption detected in September 2025
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 16, 2026; updated as evidence emerges.
What happened
BDG Law Group detected a network disruption on September 11, 2025. Its investigation confirmed that an unauthorized actor acquired information from its environment. [2]
Impact
The October 2026 public notice says potentially affected information varied by person and could include names, driver’s-license or state-ID numbers, passport numbers, medical information and Social Security numbers. [1]
BDG reported no evidence of misuse or attempted misuse at notice time. No affected-person total is established in these sources. [1]
Timeline
Network disruption detected
BDG became aware of the disruption. See the source notice.
[2]Supplemental review concluded
The individual letter dates completion of the supplemental identity review. See the source notice.
[2]Further notices published
BDG published a public notice after further individual notifications. See the source notice.
[1]Briefing updated
This briefing was last reviewed and updated on October 16, 2026.
Threat Group & Attack Vector
The reviewed notices do not establish an initial access method or identify the attacker.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
BDG secured its environment with cybersecurity specialists, reviewed the acquired dataset and supplemented that review with internal records. The individual letter says those efforts concluded September 29, 2026. [2]
BDG sent further notices after locating missing addresses and offered a call center for questions. [1]
The reviewed letter offered twelve months of credit monitoring and identity-protection assistance. [2]