Reported to the IL Attorney General on September 30, 2025.
IL residents may qualify for compensation. Free attorney review — no obligation, no upfront cost.
Check My Rights →BCM LAW, P.C. was the subject of a data breach notification filed with the IL Attorney General. The AG filing was recorded on September 30, 2025.
BCM Law, P.C. is an established litigation and defense law firm operating primarily out of Illinois, specializing in a broad range of legal services including corporate defense, insurance litigation, professional liability, and employment law. Because of the nature of its practice, the firm routinely handles, processes, and stores an extensive volume of highly sensitive documents. This includes confidential client files, proprietary corporate information, internal personnel records, financial data, and sensitive personally identifiable information (PII) belonging to litigants, employees, and third-party affiliates. Law firms are entrusted with confidential data that demands the highest standard of cybersecurity, making them prime targets for malicious actors seeking to exploit vulnerabilities in document management and communication systems. In 2025, BCM Law, P.C. reported a data security incident to the Illinois Attorney General, joining a growing number of professional services firms targeted by sophisticated cyber threats. While the exact vectors of legal industry attacks often involve unauthorized access to enterprise networks, compromised employee credentials, or targeted ransomware deployments, such incidents typically stem from inadequate network monitoring, insufficient multi-factor authentication controls, or unpatched software vulnerabilities within the firm's IT infrastructure. When threat actors breach a law firm's digital perimeter, they gain unfettered access to centralized databases and document repositories where sensitive client and employee information is stored. The data compromised in a breach of this magnitude typically includes full legal names, Social Security numbers, dates of birth, financial account details, tax documents, and confidential correspondence containing deeply personal or corporate information. The exposure of this information creates severe, immediate risks for affected individuals. When Social Security numbers and dates of birth are compromised alongside names and financial records, victims face a heightened and prolonged threat of identity theft, unauthorized credit openings, tax fraud, and financial account takeover. For individuals whose private legal matters, employment records, or financial histories were housed within the firm's systems, the breach represents a profound violation of privacy and trust with long-lasting ramifications. As a professional entity handling sensitive personal data, BCM Law, P.C. had a strict legal and ethical obligation to implement and maintain robust administrative, physical, and technical safeguards to protect information against unauthorized access and exfiltration. Under Illinois consumer protection statutes, the Personal Information Protection Act (PIPA), and common law duties of confidentiality, businesses operating within the state are required to maintain reasonable security measures and provide timely, accurate notification when a data breach occurs. A security incident of this nature strongly suggests a failure in these mandatory data security protocols, raising serious questions regarding whether the firm met its legal obligations to safeguard the sensitive records entrusted to its care. Receiving an official data breach notification letter from BCM Law, P.C. serves as formal legal acknowledgment that your personal information was compromised due to inadequate security practices. Under modern data breach jurisprudence, the receipt of such a notice establishes legal standing to pursue a class action lawsuit, enabling victims to seek accountability and compensation without needing to demonstrate that financial fraud has already occurred. Our class action law firm is actively investigating potential claims against BCM Law, P.C. to hold the organization accountable for failing to protect private data. We evaluate these cases on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket and owe no attorney fees unless we successfully recover compensation on your behalf.
Based on the data types reported in this filing, affected individuals face the following specific risks:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
Under the Illinois Personal Information Protection Act (PIPA), you may have a legal claim against BCM LAW, P.C. if any of the following apply:
Applicable law: This breach was reported under the Illinois Personal Information Protection Act (PIPA), which establishes your right to seek damages from BCM LAW, P.C..
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Once your SSN is exposed, protection becomes an ongoing expense. Plaintiffs in data breach settlements have recovered costs for credit freezes, identity protection subscriptions, and time spent dealing with fraudulent accounts — sometimes covering multiple years of exposure.
Fees charged to close and reopen accounts, issue replacement cards, or dispute fraudulent transactions are recoverable in data breach litigation. So are the costs of overdrafts, late payments, and credit damage caused by unauthorized activity.
Several state data breach laws provide for statutory minimum damages — fixed amounts recoverable per affected individual regardless of actual loss. These provisions exist specifically to make legal action viable for victims who have not yet experienced direct harm.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Illinois Personal Information Protection Act (PIPA) and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
Statutes of limitations for data breach claims vary by state but typically run 2–4 years. Depending on when you learned of the breach, you may still have time. Contact our office for a free eligibility review — there is no cost to find out.
Accepting free credit monitoring from BCM LAW, P.C. does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by BCM LAW, P.C. during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Received a notification letter from BCM LAW, P.C.?
Read our dedicated guide — what the letter means and exactly what to do.
If you were affected by the BCM LAW, P.C. data breach, you may be entitled to compensation. Submit your information below for a free attorney review — no obligation, no upfront cost.
Source: State Attorney General filing, IL
View Official AG Filing →BCM LAW, P.C. breach?
Free case review · No fee unless you win