In May 2026, AVL Growth Partners discovered suspicious activity related to one of its email accounts. An investigation confirmed that an unauthorized party had access to the account between March 26, 2026, and May 24, 2026. The company completed its internal investigation on July 22, 2026, and began notifying affected individuals in September 2026. State regulators, including the Vermont Attorney General, were notified on September 16, 2026.
The compromised data types include names, Social Security numbers, dates of birth, banking routing and account numbers, addresses, Paylocity usernames, work eligibility documents, wage and compensation information, tax return information, and direct deposit account details. While reports to state regulators confirm at least 205 individuals in Massachusetts and four in New Hampshire were affected, the total entity-level count of affected individuals remains unclear.
Details can continue to emerge as investigations progress. Consumer notification may be ongoing, and additional information could become publicly available.