On November 25, 2025, M&Y Personal Injury Lawyers (“M&Y”) detected suspicious activity within a server used for historical record keeping. According to the company’s notice, the firm immediately launched an investigation with cybersecurity specialists, terminated unauthorized access, and notified federal law enforcement. The investigation later confirmed that certain files were viewed and downloaded by an unknown actor on or about November 23, 2025. M&Y reports that there is no indication that the accessed data has been misused. Notification letters dated February 27, 2026, were subsequently mailed to affected individuals.
M&Y completed a comprehensive review to determine what information was impacted and to identify the individuals affected. The firm then validated addresses and prepared notification letters as part of its response. M&Y also reviewed its internal security policies and procedures to reduce the likelihood of future incidents.
M&Y Personal Injury Lawyers is a prominent California-based firm, founded in 2013, with over 100 years of combined experience and $800 million+ recovered for victims of car, truck, motorcycle, and slip-and-fall accidents. They provide service through offices in Los Angeles, Riverside, and other cities.
M&Y is offering complimentary credit monitoring and identity restoration services through Experian IdentityWorks. Enrollment instructions and activation codes were included in affected individuals’ notification letters. These services include identity restoration support, credit monitoring, and identity theft insurance, depending on jurisdictional availability.
The company advised recipients to remain vigilant by reviewing account statements, monitoring credit reports, and reporting suspicious activity. Additional steps—such as placing fraud alerts, initiating credit freezes, and contacting consumer protection agencies—were included in the attachment titled “Steps You Can Take to Help Protect Personal Information.”
If you received a Data Breach Notification Letter from M&Y, it confirms that your information was potentially impacted.
What information is involved in M&Y Personal Injury Lawyers Data Breach?
Compromised information may include:
Name
Social Security Number
Driver’s License Number
Government-Issued ID Number (e.g., state ID card, passport)
Financial Information (bank account, credit or debit card number)
Medical Information
Health Insurance Information
Date of Birth
Your Personally Identifiable Information (PII) includes data that can be used to identify you. When such information is exposed, individuals may face increased risks of identity theft and fraud. Cybercriminals may attempt to use breached data to open accounts, impersonate individuals, or engage in other misuse.
A specific category of PII is Protected Health Information (PHI), which pertains to personal medical data. PHI is safeguarded under federal and state laws, and entities handling PHI must ensure its confidentiality and security. Just like PII, compromised PHI may be misused by identity thieves, and cybercriminals often combine multiple data elements for greater impact.
M&Y has recommended that affected individuals enroll in the free Experian IdentityWorks protection services, monitor financial activity, and consider placing fraud alerts or credit freezes. Further instructions—along with credit bureau contact information—were provided in the notification letter and attached guidance materials.
Residents of California benefit from additional privacy protections under the California Consumer Privacy Act (CCPA), which grants enhanced rights regarding personal data. California residents also benefit from enhanced medical privacy protections under the Confidentiality of Medical Information Act (CMIA).
If you received a NOTICE OF DATA BREACH letter from M&Y, your personal information may be at risk and could be misused for identity theft or fraud.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.