The Berg Lilly P.C. Data Breach: Incident Facts and Free Case Review

In 2026, Berg Lilly P.C. formally reported a significant security incident to the Indiana Attorney General, alerting clients and regulatory authorities that unauthorized actors had gained access to its network infrastructure. While investigations into legal sector cyberattacks frequently point toward sophisticated phishing campaigns, unauthorized entry into internal document management systems, or vulnerabilities within third-party vendor platforms, a breach of this magnitude typically indicates a critical breakdown in perimeter defense and network monitoring. For a law firm, such an intrusion allows malicious actors to dwell undetected within systems, siphoning off gigabytes of confidential files before the organization realizes its defenses have been compromised.

The exposure resulting from the Berg Lilly P.C. incident involves categories of data that carry severe and long-lasting risks for affected individuals. Compromised files frequently contain full names, Social Security numbers, dates of birth, financial account details, sensitive correspondence, and confidential legal documents. When Social Security numbers and financial records are exposed, victims face an immediate and elevated threat of identity theft, fraudulent credit card applications, and unauthorized bank withdrawals. Furthermore, the leakage of confidential legal files and private personal correspondence exposes victims to targeted phishing scams, extortion risks, and severe privacy violations that can impact both personal well-being and professional standing.

As a custodian of sensitive personal and corporate data, Berg Lilly P.C. was legally obligated to implement robust administrative, technical, and physical safeguards to secure its digital environment. Under Indiana data protection statutes and broader common law principles governing the handling of confidential information, entities holding PII must maintain reasonable security procedures appropriate to the nature of the data. The occurrence of a successful network intrusion and subsequent data exfiltration strongly suggests that the firm may have failed to meet these legal standards—potentially omitting necessary protocols such as multi-factor authentication, end-to-end encryption, routine vulnerability assessments, and proactive employee cybersecurity training.

For individuals who have received an official data breach notification letter from Berg Lilly P.C., this correspondence serves as formal acknowledgement that your private information was compromised due to inadequate security measures. Legally, the receipt of this notice establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the firm accountable. Affected parties do not need to wait until financial fraud occurs to seek legal recourse. Our firm investigates these matters on a contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.