Fragomen, Del Rey, Bernsen & Loewy, LLP Data Breach — Case File

From the AG filing description

Fragomen, Del Rey, Bernsen and Loewy, LLP is a preeminent global immigration law firm that handles sensitive legal, corporate, and governmental matters for thousands of multinational corporations and individual clients. Because of the nature of its global practice, the firm routinely collects, processes, and stores vast repositories of highly confidential information. This includes not only internal operational data and personnel records, but also extensive personal dossiers for corporate employees seeking visas, work permits, and permanent residency. The types of documents managed by the firm frequently include passports, foreign national identification numbers, employment contracts, financial statements, and detailed background check histories, making it a critical custodian of sensitive cross-border data. In 2026, Fragomen reported a significant data security incident to the Office of the Attorney General of Texas, signaling that unauthorized actors may have breached its network or digital infrastructure. While law firm data breaches can stem from various vulnerabilities—such as targeted phishing campaigns, sophisticated ransomware deployments, or third-party vendor compromises—they typically exploit weaknesses in perimeter defenses or document management systems. Given the high-value nature of legal repositories, threat actors increasingly target law firms to intercept confidential communications, intellectual property, and extensive personally identifiable information belonging to high-profile corporate clients and foreign nationals. The exposure of data held by a premier immigration and corporate law firm creates severe, long-term risks for affected individuals. Compromised information commonly includes full names, Social Security numbers, dates of birth, passport details, visa documentation, and financial background details. When passport numbers and foreign identification data fall into the wrong hands, victims face heightened threats of identity theft, synthetic fraud, and targeted spear-phishing attacks. Furthermore, because immigration records often contain employment histories, home addresses, and familial details, victims are uniquely vulnerable to social engineering schemes and unauthorized attempts to impersonate them before government agencies. As a professional services entity handling sensitive personal information, Fragomen was bound by rigorous legal obligations under state data protection statutes, common-law duties of confidentiality, and general standards of reasonable cybersecurity care. These laws mandate the implementation of robust administrative, physical, and technical safeguards—such as multi-factor authentication, robust encryption standards, and continuous network monitoring—to protect stored consumer and client data. A breach of this magnitude strongly suggests potential failures in maintaining adequate security protocols, leaving the firm vulnerable to avoidable intrusions that endangered the privacy and financial security of countless individuals. Receiving a data breach notification letter from Fragomen, Del Rey, Bernsen and Loewy, LLP is a formal acknowledgment that your private information was compromised due to inadequate data security. Legally, this notice establishes your standing to participate in a class action lawsuit aimed at holding the firm accountable for its security lapses. Under modern consumer protection jurisprudence, victims do not need to prove that they have already suffered actual financial loss to seek legal recourse; the mere increased risk of future identity theft constitutes a cognizable harm. Our firm is currently investigating potential class action claims on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.