A Los Angeles-based law firm recently announced a major data breach involving sensitive personal records, but only after waiting more than a year. This delay shows the risk families face when trusting professional institutions with private information. For parents and educators, the gap between the theft and public notification means they must take proactive steps to protect children's identities.
What Happened
According to a public notification from the BDG Law Group, the firm detected a network disruption on September 11, 2025. After hiring cybersecurity experts to investigate, the firm discovered that an unauthorized actor had acquired a dataset containing personal files. However, the law firm did not release a public notice about the breach until October 14, 2026, more than 13 months after the initial intrusion.
The compromised database contained names paired with driver's licenses, state identification numbers, passport numbers, medical histories, and Social Security numbers. BDG Law Group stated that the specific information exposed varied by individual. The firm has set up a toll-free helpline to assist those affected.
The Bigger Picture
For families, the year-long delay leaves a long window of vulnerability. Data breach reporting laws vary widely by region. According to the Privacy Law Network, 21 states enforce strict outer limits for notifying victims, with several imposing a 30-day window once a breach is confirmed. Other states require organizations to report compromises "without reasonable delay" so consumers can protect their assets.
However, these laws have a loophole. As noted by the American Bar Association, the legal clock for notifications typically begins when an organization formally determines that a reportable breach occurred, rather than when the hack actually happened. This distinction allows organizations to spend months investigating internally while victims remain unaware that their personal files are exposed.
What This Means for Families
When professional entities suffer a breach, children are often the most vulnerable. Because minors do not have active credit reports, identity thieves can use their Social Security numbers to open fraudulent bank accounts, get loans, or apply for government benefits unnoticed. Parents often do not realize their child's identity is stolen until the child reaches adulthood and applies for their first credit card or student loan.
While companies frequently claim there is "no evidence of immediate misuse" after a cyberattack, stolen files remain highly valuable on the black market. For example, when hackers breached the London-based childcare provider Kido International, they immediately published children's names and photos online to extort a ransom. In another incident involving pediatric medical data, parents received minimal corporate support and vague details about what files were stolen. Dark web listings also reveal that large batches of student records are actively traded by cybercriminals, a threat that outlasts short-term monitoring services.
What You Can Do
To protect your children, you can proactively freeze their credit files with the three major credit bureaus. This prevents identity thieves from opening accounts in their name. You can start the process on Experian.
Also, watch for physical mail addressed to your child. Pre-approved credit card offers, bills, or notices from the IRS are warning signs that someone is using their Social Security number.
If you discover your child's identity has been stolen, file a report with the Federal Trade Commission right away. Review the Consumer Financial Protection Bureau identity theft recovery guidelines to start credit freezes and disputes.