Legal Services of Long Island Data Breach Exposes Sensitive Personal and Health Information

Legal Services of Long Island, a non-profit law firm that provides free civil legal services to low-income and disabled residents of Nassau and Suffolk Counties in New York, disclosed a data breach involving sensitive personal, financial and health information. A total number of 94,434 people were impacted.

After detecting suspicious activity within its technical environment, Legal Services of Long Island brought in cybersecurity and data forensic specialists to contain the incident.

On Jan. 5, 2026, the forensic team began reviewing files that had been accessed by an unauthorized third party.

On May 15, 2026, the investigation determined that an unauthorized third party had accessed certain systems within the organization's network and removed data from its environment.

The types of information exposed included both personally identifiable information and protected health information including addresses, dates of birth, Social Security numbers, government ID numbers, biometric information, credit and debit account information and financial account codes, diagnosis information, treatment information and doctor or medical professional names.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation and to the Vermont Attorney General starting on June 12, 2026.

Legal Services of Long Island's response to the breach

Legal Services of Long Island is offering affected individuals free identity theft protection services through IDX, a data breach and recovery services provider. The IDX services include up to 24 months of credit monitoring with around-the-clock coverage, a $1,000,000 insurance reimbursement policy and a dark web monitoring tool.

Affected individuals who received a notification letter can enroll by visiting the IDX enrollment page, by calling 1-855-759-9333 or by scanning the QR code included in their letter. An enrollment code printed on the notification letter is required to complete registration.

IDX representatives are available Monday through Friday from 9 a.m. to 9 p.m. Eastern Time to answer questions about the incident and assist with enrollment. The deadline to enroll is Sept. 1, 2026.