The National Boat Owners Association (NBOA), a marine insurance agency based in Sarasota, Florida, experienced a data breach affecting 3,580 individuals nationwide. The breach occurred between mid-May and early June 2025, with discovery on June 6, 2025. This was identified as a vendor/third-party breach, as cybercriminals gained access to NBOA’s network through a compromised managed service provider. The INC Ransomware group claimed responsibility for the attack on July 22, 2025. NBOA has since terminated the vendor, engaged a forensic firm, and enhanced its cybersecurity measures.
Confirmed data types exposed in the breach include full names, addresses, driver's licenses, Social Security numbers (SSNs), insurance information, and insurance policy numbers. Some reports also indicate potential exposure of tax documents, W2s, and other financial files based on ransomware claims. The breach affected individuals in at least Massachusetts, New Hampshire, Maine, Vermont, and Indiana, with a nationwide impact reported. NBOA began notifying affected individuals via mailed letters starting January 21, 2026, and is offering complimentary 24-month Experian IdentityWorks services, which include identity and credit monitoring, along with a $1 million theft insurance policy.
Details about the full scope of the breach and any further actions may emerge. Notices to affected individuals may also still be in process.