ICW Group Holdings, Inc. reported that a social engineering incident allowed an unknown party to access documents on company systems. The unauthorized access occurred between May 1 and May 4, 2026. The company became aware of the incident on May 19, 2026, and on November 5, 2026, determined that personal information was present in the accessible data. Notification began on November 13, 2026.
The specific data types and total number of affected individuals have not been publicly disclosed in the available sources. The California Attorney General-related reporting cited by a law firm states that more than 500 California residents were affected; that figure does not establish the total number affected across all locations. The available sources do not confirm exposure of Social Security numbers, medical information, or financial information.
Further details, including the affected population and data types, may emerge as additional notices or filings become available. The available sources do not establish that the incident involved a third-party vendor.