Lozano Smith lozanosmith.com Lozano Smith data breach: what happened and what to do
Lozano Smith, a California law firm, notified people in December 2021 that an intruder accessed its systems in January 2020 and tried to encrypt them in April 2021. Names, addresses and Social Security numbers could have been accessed. The number affected isn't stated in the sources.
View all 13,177 breaches- Breach date
- Jan 2020
- Made public
- 14 Dec 2021
- Data exposed
- Names, Physical addresses, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Lozano Smith is a California law firm. Its notice letter, dated December 14, 2021, says the firm became aware of unusual activity on its systems on April 7, 2021. It says an unauthorized person had access in January 2020 but didn't try to encrypt its systems until April 2021, and that its immediate response stopped the encryption.
The California Attorney General's breach list carries the notice. The sources used here don't give a total number of affected people.
Sources checked: oag.ca.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
The firm's filing with the Maine Attorney General lists names, addresses and Social Security numbers as information that could have been accessed. The notice says it could have been, not that it was taken. Law firms hold records for their clients and employees, so you could be affected without having dealt with the firm directly.
What it means for you
A Social Security number with a name and address is the core of an identity theft attempt: a new credit card, a loan or a tax refund filed in your name. Because the access began in early 2020, the gap before notification is long, so checking your credit reports is worthwhile.
The company's response
Written notice went out on or about December 14, 2021 to affected individuals. The notice tells recipients how to protect their information.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A Social Security number is in the exposed data, so a freeze is the strongest step. Per the FTC, a freeze is free, lasts until you lift it, and you place it separately at Equifax, Experian and TransUnion. You can also place a free fraud alert, which tells lenders to verify your identity first.
- 2
Watch your statements and credit reports
Check bank, card and insurer statements for charges or claims you don't recognize. The FTC's breach guidance walks through reporting identity theft if it happens.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear. It can't remove data that has already leaked, so the steps above still matter.
Official filings
- California Attorney General , filed 14 Dec 2021
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Lozano Smith breach?
If you got a letter dated around December 14, 2021, yes. Otherwise, contact the firm and ask whether your information was involved.
What was exposed?
The notice lists names, addresses and Social Security numbers as information that could have been accessed.
Should I freeze my credit?
If your notice mentions your Social Security number, yes. The FTC says a freeze is free and lasts until you lift it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
