Hulberg and Associates Data Breach Lawsuit Investigation
Were you notified that Hulberg & Associates was hacked? A recent ransomware attack may have leaked your Social Security number, banking details and more. Find out how to protect yourself and whether you can file a claim.
What Happened?
On July 11, 2025, Hulberg & Associates — a long-standing real-estate appraisal and consulting firm based in San Jose, California — detected suspicious activity on an internal human-resources server. A forensic review confirmed that the PLAY ransomware gang infiltrated the network, exfiltrated sensitive data, and threatened to publish it on July 18, 2025.
The company began mailing breach notices on Aug 19, 2025, and filed reports with state regulators in Washington and Massachusetts. The exact number of affected individuals has not been disclosed, but current and former employees as well as independent contractors are included.
What Information Was Exposed?
The stolen files contained highly sensitive personally identifiable information (PII) and financial data, including:
- Full names
- Social Security numbers
- Dates of birth
- Driver’s license or other government-issued ID numbers
- Residential addresses
- Bank account and routing numbers (used for direct deposit)
- Medical or health-related information
Your Immediate Action Plan
The company is offering 24 months of free Experian IdentityWorks credit monitoring and identity-restoration services. Even if you enroll, take these extra precautions:
- Activate credit monitoring: Use the activation code provided in your letter before the deadline.
- Check your statements weekly: Look for unfamiliar charges or withdrawals.
- Place a fraud alert or freeze: Contact any major credit bureau to make opening new accounts harder for criminals.
- Beware of phishing: Scammers may impersonate Hulberg & Associates or Experian to steal additional data.
Can You File a Lawsuit?
Data-breach laws allow victims to seek monetary relief for:
- Time spent monitoring and securing accounts
- Out-of-pocket expenses (e.g., credit-freeze fees, notary costs)
- Actual identity-theft losses
- Future risk of fraud and emotional distress
Attorneys are actively investigating claims on behalf of everyone whose information was compromised. Completing a short case-evaluation form can help preserve your rights and potential compensation.
Company Response
Besides offering credit monitoring, Hulberg & Associates states it has:
- Secured and rebuilt affected servers
- Engaged third-party cybersecurity experts
- Tightened network monitoring and endpoint defenses
- Enhanced employee security training
Download the Official Breach Notice
Download Official Breach Notice (PDF)
Frequently Asked Questions
What makes the Hulberg & Associates data breach serious?
The incident involves highly sensitive data—Social Security numbers, banking information, dates of birth—creating a substantial risk of identity theft and financial fraud.
How do I know if my information was involved?
Hulberg & Associates mailed official notification letters beginning Aug 19, 2025. If you received one, you were likely affected. You can also review the Washington AG notice linked above.
Is credit monitoring from Hulberg & Associates really free?
Yes. The company is covering 24 months of Experian IdentityWorks. Enroll as soon as possible; the offer may expire.
Can I still sue Hulberg & Associates if I use their credit monitoring?
Enrolling in credit monitoring does not waive your legal rights. You may still pursue compensation for losses or time spent safeguarding your identity.
What compensation could I receive from a Hulberg & Associates lawsuit?
Potential damages include reimbursement for fraudulent charges, credit-protection costs, lost time, and possibly statutory or punitive damages, depending on state law.
How long do I have to take action?
Each state imposes its own statute of limitations on data-breach claims—often three to four years. Acting quickly ensures critical evidence is preserved.
Next Steps
If you received a breach notice, document everything: the letter, any unusual account activity, and time spent resolving issues. Then speak with a qualified data-breach attorney to explore your legal options.
Time is limited—protect your identity and your rights today.