Ransomware at the Law Foundation of Silicon Valley exposed data on 42,525 people

The Law Foundation of Silicon Valley, a California nonprofit that provides free legal services to people who cannot afford them, was hit by a ransomware attack on February 18, 2023. Data held on one server was compromised. The organization notified regulators in California and Maine in July 2023 and put the number of clients, staff members and other individuals affected at 42,525.

A forensic investigation by outside cybersecurity specialists concluded on June 1, 2023. It found that Social Security numbers, medical records, immigration numbers and financial data had been compromised. Driver's license numbers, financial account and payment card information, passport and other government identification, taxpayer identification numbers, dates of birth and digital signatures may also have been involved. The exact combination varied by individual.

The ALPHV/BlackCat ransomware group claimed responsibility in March 2023, several weeks after the intrusion.

Formal notifications began once the investigation closed. The Law Foundation offered affected people twelve months of credit monitoring, identity protection services and identity theft insurance, and set up a dedicated call center. Chief executive Alison Brunner said the organization works with people on important and sensitive life issues and that the breach struck at the core of its nonprofit mission. Coverage of the incident noted that legal aid providers hold unusually sensitive client records while typically operating with limited IT resources.