Fragomen, Del Rey, Bernsen & Loewy, LLP, a major immigration law firm, notified the California Attorney General in October 2026 of a data breach involving personal information. The exact number of affected individuals and full details of exposed data have not been publicly disclosed. Anyone connected to the firm’s immigration services should monitor credit reports and consider a credit freeze immediately.
| Company | Fragomen, Del Rey, Bernsen & Loewy, LLP |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Full Names, Social Security Numbers, Government Identification Numbers, Dates of Birth, Contact Information, Employment Records, Financial Information |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | California Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Fragomen Data Breach?
Fragomen, Del Rey, Bernsen & Loewy, LLP has filed a formal data breach notification with the California Attorney General. The filing confirms that personal information tied to the firm’s operations was compromised. Fragomen is one of the largest immigration law firms in the country, so this disclosure raises concern for many individuals who shared sensitive records with the firm.
According to the notification, the breach notification date is October 2026. However, the exact date the intrusion was discovered has not been publicly disclosed. As a result, the full timeline of how long attackers may have had access remains unclear at this point.
The notification does not specify the precise method used to gain access to the firm’s systems. Because Fragomen handles large volumes of sensitive immigration and employment-related records, any unauthorized access to its network could expose highly detailed personal data. The firm’s filing with regulators indicates that it undertook a review of the incident before notifying affected individuals.
In response to the discovery, Fragomen appears to have conducted an internal investigation to determine the scope of the compromise. This is a standard step for organizations handling legal and compliance-sensitive data. Additional details about the forensic investigation have not been made public at this time.
Who was affected?
The individuals affected by this breach likely include clients, employees, or applicants whose records were processed through Fragomen’s immigration services. Because the firm works extensively with corporate clients on visa and work-authorization matters, affected individuals may include foreign nationals, sponsored employees, and their family members.
The exact number of people affected has not been publicly disclosed. This means the scope of the breach, whether it touched a small group or a much larger population, is still uncertain. Given the nature of immigration law practice, the affected population may span multiple states and even multiple countries.
In addition, it is possible that minors could be included among those affected, since family-based immigration cases often involve dependents. Because Fragomen serves corporate clients across many industries, the breach could also indirectly affect employees of companies that rely on the firm’s immigration services.
What Information Was Potentially Exposed?
The specific categories of information exposed in this breach have not been fully detailed in the public notification. However, based on the nature of Fragomen’s legal practice, the data it holds for clients is often highly sensitive. Immigration case files frequently contain extensive personal and biographical information.
- Full names
- Social Security numbers
- Government identification numbers (such as passport or visa numbers)
- Dates of birth
- Contact information (addresses, phone numbers, email addresses)
- Employment-related records
- Financial information connected to sponsorship or case processing
Because this type of data is so detailed, the risk of identity theft is significant. For example, a Social Security number combined with a date of birth and government ID number gives criminals nearly everything needed to open fraudulent accounts. This is especially concerning for individuals navigating immigration status, since fraudulent use of their identity could complicate legal proceedings.
In addition, exposed financial information could lead to unauthorized charges or new account fraud. Victims may also face targeted phishing attempts that reference real case details to appear credible. As a result, affected individuals should treat any unexpected communication about their immigration case or finances with caution.
What is the company doing?
Fragomen filed a formal notification with the California Attorney General in October 2026, disclosing the breach as required under state law. This filing indicates that the firm has acknowledged the incident and taken steps to meet its legal notification obligations.
Beyond the regulatory filing, specific remediation steps have not been publicly detailed. Many firms in similar situations offer credit monitoring or identity protection services to affected individuals, though this has not been confirmed in the available notification. Affected individuals should watch for a direct notification letter from the firm, since it may include specific guidance and any protective services being offered.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should check their credit reports regularly for signs of unfamiliar activity. You can request a free copy of your credit report from each of the three major bureaus through AnnualCreditReport.com. Reviewing these reports often helps catch fraudulent accounts early.
Because Social Security numbers and government ID numbers may have been exposed, ongoing vigilance is especially important. Consider spacing out your free reports throughout the year so you have continuous visibility into your credit file. If you notice any accounts you don’t recognize, report them to the credit bureau immediately.
Consider a Fraud Alert or Credit Freeze
Given the potential exposure of Social Security numbers and financial details, placing a fraud alert or credit freeze is a smart precaution. A fraud alert requires creditors to verify your identity before opening new credit in your name. A credit freeze goes further by blocking access to your credit file entirely.
To set up either protection, contact one of the three major credit bureaus directly, since a fraud alert placed with one bureau is required to notify the others. A credit freeze must be requested separately with each bureau. Although a freeze takes a few extra steps when you need to apply for credit yourself, it offers strong protection against identity thieves.
Watch for Phishing and Scam Attempts
Because this breach may involve detailed personal and case-related information, scammers could craft convincing phishing messages. For example, a fraudulent email might reference your immigration case number or visa status to seem legitimate. Be cautious of any unsolicited messages asking for further personal details or payment.
Never click links or provide information in response to unexpected emails or calls, even if they appear to come from a known organization. Instead, verify requests by contacting the organization directly through a known phone number or website. This simple habit can prevent many common scams tied to data breaches.
Protect Immigration and Legal Case Information
If you have an active case with Fragomen, consider reaching out to confirm your case status and verify that no unauthorized changes have been made. This is particularly important given the sensitive nature of immigration proceedings. Any unusual activity related to your case should be reported right away.
In addition, keep copies of your important documents and case correspondence in a secure location. This way, you have a clear record to reference if you need to dispute any fraudulent activity connected to your identity or immigration status. Consulting with a data breach attorney can also help you understand your rights and options for recourse.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification from California Attorney General