Notice of Data Incident

Berkeley Research Group, LLC (“BRG” or “we”) is providing notice of an incident that may have affected protected health information and/or personally identifiable information stored in our systems.

What Happened?

On March 2, 2025, BRG discovered suspicious network activity including indicators of compromise consistent with a ransomware attack (the “Incident”). Upon discovery, BRG immediately took steps to contain and remediate the situation, including taking systems offline, engaging cybersecurity and privacy professionals to assist, and beginning a forensic investigation, which identified that unauthorized activity occurred between February 28, 2025, and March 2, 2025.

At this time, and due to the nature of the Incident, the investigation remains ongoing into the types of data (“Information”) and identity of individuals who were affected by the Incident. While this analysis continues, we are providing this notice so any individuals who may be potentially affected are made aware of the situation.

What Information Was Involved?

Our investigation into the scope of impacted Information is ongoing, but we anticipate that it includes information that can be used to identify specific individuals. The individual notification letters that will be sent out at the conclusion of our investigation will have a list of data elements impacted for that individual.

What We Are Doing

Upon discovering the Incident, we immediately took measures to improve the security of our systems, including resetting credentials for all users, implementing enhanced endpoint detection monitoring, and enforcing stricter access controls and authentication procedures. After confirming containment of the Incident, we have been working diligently to continue our investigation and understand the full scope of Information impacted. We continue to work with leading privacy and security professionals to aid in our investigation and response, and we are reporting this Incident to relevant government agencies. We are also working with experienced cybersecurity professionals to improve our security and privacy practices going forward.

What Can Impacted Individuals Do?

BRG encourages individuals to remain vigilant against incidents of identity theft and fraud; review account statements and explanation of benefits forms; and monitor free credit reports for suspicious activity and to detect errors. Under US law, individuals are entitled to one (1) free credit report annually from each of the three (3) major credit reporting bureaus. Additional information and resources are outlined below.

If you have questions for BRG, you can contact us at ITIncidentInquiries@thinkbrg.com.

Steps You Can Take to Protect Your Personal Information

To obtain a free credit report, individuals may visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228.

Alternatively, affected individuals can contact the three (3) major credit reporting bureaus directly at the addresses below:

Equifax, PO Box 740241, Atlanta, GA 30374, www.equifax.com, 1-800-685-1111
Experian, PO Box 2104, Allen, TX 75013, www.experian.com, 1-888-397-3742
TransUnion, PO Box 2000, Chester, PA 19022, www.transunion.com, 1-800-888-4213

Free Credit Report.  It is recommended that you remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring your credit report for unauthorized activity.  You may obtain a copy of your credit report, free of charge, once every twelve (12) months from each of the three (3) nationwide credit reporting agencies.

To order your annual free credit report, please visit www.annualcreditreport.com or call toll free at 1-877-322-8228.

You can also order your annual free credit report by mailing a completed Annual Credit Report Request Form (available from the US Federal Trade Commission’s (FTC) website at www.consumer.ftc.gov) to: Annual Credit Report Request Service, PO Box 105281, Atlanta, GA 30348-5281.

For Colorado, Georgia, Maine, Maryland, Massachusetts, New Jersey, Puerto Rico, and Vermont residents: You may obtain one (1) or more (depending on the state) additional copies of your credit report, free of charge. You must contact each of the credit reporting agencies directly to obtain such additional report(s).

Fraud Alert. You may place a fraud alert in your file by calling one (1) of the three (3) nationwide credit reporting agencies above.  A fraud alert tells creditors to follow certain procedures, including contacting you before they open any new accounts or change your existing accounts.  For that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit.

Security Freeze.  You may obtain a security freeze on your credit report, free of charge, to protect your privacy and confirm that credit is not granted in your name without your knowledge.  You may also submit a declaration of removal to remove information placed in your credit report as a result of being a victim of identity theft.  You have a right to place a security freeze on your credit report, free of charge, or submit a declaration of removal pursuant to the Fair Credit Reporting Act (FCRA).

The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization or approval.  The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent.  When you place a security freeze on your credit report, you will be provided with a personal identification number, password, or similar device to use if you choose to remove the freeze on your credit report or to temporarily authorize the release of your credit report to a specific party or parties or for a specific period of time after the freeze is in place.

To place a security freeze on your credit report, you may be able to use an online process, an automated telephone line, or a written request to any of the three (3) credit reporting agencies listed above. The following information must be included when requesting a security freeze (note that if you are requesting a credit report for your spouse, this information must be provided for them as well): (1) full name, with middle initial, and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any applicable incident report or complaint with a law enforcement agency or a state department of motor vehicles. The request must also include a copy of a government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, and display your name, current mailing address, and the date of issue.

FTC and State Attorneys General Offices. If you believe you are the victim of identity theft or have reason to believe your personal information has been misused, you should immediately contact the FTC and/or the Attorney General’s office in your home state. You may also contact these agencies for information on how to prevent or avoid identity theft.

You may contact the Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue NW, Washington, DC 20580, www.ftc.gov/bcp/edu/microsites/idtheft/, 1-877-IDTHEFT (438-4338).

For Alabama residents:  You may contact the Attorney General’s Office for the State of Alabama, Consumer Protection Division, 501 Washington Avenue, Montgomery, AL 36104, https://www.alabamaag.gov, 1-800-392-5658.

For California residents: Visit the California Office of Privacy Protection (www.oag.ca.gov/privacy) for additional information on protection against identity theft. Office of the Attorney General of California, 1300 I Street, Sacramento, CA 95814, 1-800-952-5225. This notification was not delayed as a result of any law enforcement investigation.

For Colorado residents: You can obtain information from the FTC and the credit reporting agencies about fraud alerts and security freezes.

For Connecticut residents: You may contact the Connecticut Office of the Attorney General, 165 Capitol Avenue, Hartford, CT 06106, www.ct.gov/ag, 1-860-808-5318.

For District of Columbia residents: You can obtain information about steps to take to avoid identity theft from the FTC (contact information above) and the District of Columbia Office of the Attorney General, 400 6th Street NW, Washington, DC 20001, consumer.protection@dc.gov, https://oag.dc.gov/, 1-202-737-3400.

For Illinois residents:  You can obtain information from the credit reporting agencies and the FTC about fraud alerts and security freezes (contact information above). You may contact the Illinois Office of the Attorney General, 100 West Randolph Street, Chicago, IL 60601, https://illinoisattorneygeneral.gov/about/email_ag.jsp, 1-800-964-3013.

For Iowa residents: You may contact the Iowa Office of the Attorney General, 1305 E Walnut Street, Des Moines, IA 50319, consumer@ag.iowa.gov, 1-888-777-4590.

For Kansas residents: You may contact the Kansas Office of the Attorney General, Consumer Protection Division, 120 SW 10th Ave, 2nd Floor, Topeka, KS 66612-1597, https://ag.ks.gov/, 1-800-432-2310.

For Kentucky residents: You may contact the Kentucky Office of the Attorney General, Consumer Protection Division, 1024 Capital Center Drive, Suite 200, Frankfort, Kentucky 40601, www.ag.ky.gov, 1-800-804-7556.

For Maryland residents: You may obtain information about steps you can take to avoid identity theft from the FTC (contact information above) and the Maryland Office of the Attorney General, Consumer Protection Division, 200 St. Paul Place, Baltimore, MD 21202, www.marylandattorneygeneral.gov, 1-888-743-0023.

For Massachusetts residents: You may contact the Office of the Massachusetts Attorney General, 1 Ashburton Place, Boston, MA 02108, www.mass.gov/ago/contact-us.html, 1-617-727-8400.

For Minnesota residents:  You may contact the Minnesota Office of the Attorney General, 445 Minnesota Street, Suite 1400, St. Paul, MN 55101, www.ag.state.mn.us, 1-800-657-3787.

For Missouri residents:  You may contact the Missouri Office of the Attorney General, Consumer Protection, 207 W High St., PO Box 899, Jefferson City, MO 65102, www.ago.mo.gov, 1-800-392-8222.

For Nevada residents: You may contact the Nevada Office of the Attorney General, Bureau of Consumer Protection, 100 N Carson St, Carson City, NV 89701, www.ag.nv.gov, 1-702-486-3132.

For New Mexico residents: Consumers have rights pursuant to the FCRA, such as the right to be told if information in their credit file has been used against them, the right to know what is in their credit file, the right to ask for their credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the FCRA, the consumer reporting bureaus must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to consumers’ files is limited; consumers must give consent for credit reports to be provided to employers; consumers may limit “prescreened” offers of credit and insurance based on information in their credit report; and consumers may seek damages from violators. Consumers may have additional rights under the FCRA not summarized here. Identity theft victims and active-duty military personnel have specific additional rights pursuant to the FCRA. We encourage consumers to review their rights pursuant to the FCRA by visiting www.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf, or by writing Consumer Response Center, Room 130-A, Federal Trade Commission, 600 Pennsylvania Ave NW, Washington, DC 20580.

For New York residents: You may obtain information regarding security breach response and identity theft prevention and protection information from the FTC (contact information above) and the New York Office of the Attorney General, Office of the Attorney General, The Capitol, Albany, NY 12224-0341, https://ag.ny.gov, 1-800-771-7755.

For North Carolina residents: You may obtain information about preventing identity theft from the FTC (contact information above) and the North Carolina Office of the Attorney General, Consumer Protection Division, 9001 Main Service Center, Raleigh, NC 27699-9001, www.ncdoj.gov, 1-877-566-7266 or 1-919-716-6400.

For Oregon residents: You may contact the Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096, www.doj.state.or.us/, 1-877-877-9392.

For Pennsylvania residents: You may contact the Pennsylvania Office of the Attorney General, Bureau of Consumer Protection, 15th Floor, Strawberry Square, Harrisburg, PA 17120, www.attorneygeneral.gov, 1-800-441-2555.

For Rhode Island residents: You may contact the Rhode Island Office of the Attorney General, Consumer Protection Division, 150 South Main Street, Providence, RI 02903, www.riag.ri.gov, 1-401-274-4400.

For Texas residents: You may contact the Texas Office of the Attorney General, Office of the Attorney General, PO Box 12548, Austin, TX 78711-2548, www.texasattorneygeneral.gov, 1-800-621-0508.

For Wyoming residents: This notification was not delayed as a result of any law enforcement investigation.

Reporting of Identity Theft and Obtaining a Police Report. You have the right to obtain any police report filed in the United States in regard to this incident. If you are the victim of fraud or identity theft, you also have the right to file a police report.

For Iowa residents:  You are advised to report any suspected identity theft to law enforcement or to the Iowa Attorney General.
For Massachusetts residents: You have the right to obtain a police report if you are a victim of identity theft.
For North Carolina residents: You are advised to report any suspected identity theft to law enforcement or to the North Carolina Attorney General.
For Oregon residents:  You are advised to report any suspected identity theft to law enforcement, the FTC, and the Oregon Attorney General.

Protecting Medical Information

If you are concerned about protecting your medical information, the following practices can provide additional safeguards to protect against medical identity theft.

Only share your health insurance cards with your healthcare providers and other family members who are covered under your insurance plan or who help you with your medical care.
Review your “explanation of benefits statement,” which you receive from your health insurance company. Follow up with your insurance company or care provider for any items you do not recognize. If necessary, contact the care provider on the explanation of benefits statement and ask for copies of medical records from the date of the potential access (noted above) to current date.
Ask your insurance company for a current year-to-date report of all services paid for you as a beneficiary. Follow up with your insurance company or the care provider for any items you do not recognize.