Department of Justice says data breach exposed information on diocesan sex abuse survivors

U.S. Department of Justice headquarters building in Washington, D.C. / Credit: Bjoertvedt, CC BY-SA 3.0, via Wikimedia Commons

CNA Staff, May 9, 2025 / 13:32 pm (CNA).

The U.S. Department of Justice says a recent data breach of a California consulting firm exposed data of Catholic clergy abuse survivors in nearly a dozen bankruptcy lawsuits. 

In a May 6 letter addressed to attorneys at law firm Proskauer Rose LLP, the Justice Department’s Nan Eitel, the associate general counsel for Chapter 11 practice in the Executive Office for United States Trustees, said that late last month multiple government trustees received notice of a data breach at Berkeley Research Group (BRG).

The Emeryville, California-based BRG offers corporate finance and economic consulting, including to Catholic dioceses in bankruptcy proceedings. The government’s letter said the data breach had occurred on March 2 but that trustees were only first informed on April 28. 

The breach “affected multiple Chapter 11 cases … and the security of data maintained by BRG in its role as a financial adviser to official committees in those cases,” the letter said. 

The breach included data associated with 10 Catholic bankruptcy cases, nine of which are diocesan or archdiocesan cases and one of which was filed by the Franciscan Friars of California. 

“Although such a large-scale data breach would be of concern to the United States Trustee in any bankruptcy case, that the breach occurred in archdiocesan and diocesan cases — where the claims information of sexual abuse survivors is the most sensitive and confidential of all information — is very concerning,” the government said. 

The “incident update” provided by the Berkeley Research Group “raised more questions than it answered about what transpired and what BRG has done and intends to do going forward to remediate the breach in each case,” the government said. 

BRG “file[d] a single generic notice on each affected case docket” and did not contact each affected party individually, the government alleged.

The company’s response appears “wholly deficient” to the scope of the breach, the Justice Department argued. It demanded the company provide information on each affected case as well as clarify why the company “delayed two months” before notifying trustees and whether or not the company has contacted federal law enforcement over the breach. 

Among the affected bankruptcy cases include those of the archdioceses of Baltimore and New Orleans as well as the dioceses of Albany and Rochester, among others.

New York-based law firm Proskauer Rose LLP did not immediately respond to an email from CNA asking if it was the legal representative of BRG.