AVL Growth Partners Data Breach

AVL Growth Partners, an Ampleo Company, provides fractional financial guidance services to businesses across the country. The firm recently notified affected individuals that some of their personal information may have been involved in a security event tied to files the firm maintained on behalf of a client. Companies that hold financial and personal records on behalf of their clients carry a responsibility to protect that information, and when a breach like this occurs, those affected deserve a clear explanation of what happened and what they can do next.

AVL Growth Partners’s Data Breach Investigation

AVL Growth Partners identified that files containing certain personal information, including at least the names of affected individuals, were present in files involved in a security event. The notification letters sent to affected individuals did not disclose the full scope of what other information may have been included, which is consistent with early-stage breach notifications where companies are still completing forensic review or are limited by state notification law in what they can disclose publicly.

Financial services and professional services firms like AVL Growth Partners are frequent targets for cybercriminals because they often store sensitive financial records, tax documents, and personal identifying information for many client businesses and their employees or customers at once. A single compromise of a fractional CFO or accounting firm’s systems can therefore expose data belonging to numerous downstream individuals who never had a direct relationship with the firm itself, which is part of why these incidents can be so consequential.

When personal information such as a name is exposed in combination with other data points a company has not fully disclosed, affected individuals are often left uncertain about their actual level of risk. Notification letters that are limited in detail are not unusual, particularly where a state’s data breach notification statute restricts what a company can say in a public-facing letter, but that limitation does not reduce the importance of taking precautionary steps in response.

AVL Growth Partners has stated it is reviewing its internal policies and procedures following this event with the goal of reducing the likelihood of similar incidents occurring in the future. As with most breach notifications, the company has offered affected individuals complimentary credit monitoring and identity restoration services as a precaution, even where there is no confirmed evidence of misuse.

Individuals affected by a breach like this are typically encouraged to enroll in any offered monitoring services promptly and to remain alert to phishing attempts that reference the breach, since scammers frequently use news of a data breach to craft more convincing follow-up scams. Regularly reviewing account statements, monitoring credit reports, and considering a credit freeze are all reasonable precautionary measures even when the specific data exposed has not been fully detailed.

Data breach notification laws in states like Vermont and Massachusetts require companies to report incidents affecting residents’ personal information within specific timeframes and to notify each state’s Attorney General’s office of the scope of the event. Filing in multiple states is common for firms that serve clients nationwide, since a single security event can affect residents across many jurisdictions at once, each with its own notification requirements and deadlines.

Even when only limited categories of information, such as a name, are confirmed exposed, that data can still be combined with information from other sources to enable identity theft, targeted phishing, or account takeover attempts. This is why security professionals generally recommend that affected individuals treat any breach notification seriously regardless of how limited the confirmed exposure appears to be, and take the precautionary steps outlined below.

When Did This Breach Occur?

AVL Growth Partners has not publicly disclosed the specific date the security event occurred or when it was first discovered. The company began notifying affected individuals and reporting the incident to state regulators, including in Vermont and Massachusetts, as part of its legal notification obligations.

What Information Was Breached?

Based on the notification sent to affected individuals, AVL Growth Partners confirmed that names were present in the affected files. The company has not publicly specified whether additional categories of personal information, such as Social Security numbers or financial account information, were also involved.

What You Can Do

AVL Growth Partners is offering affected individuals 24 months of complimentary credit monitoring and identity restoration services through Epiq. Consider taking the following steps:

• Enroll in the complimentary credit monitoring services offered in your notification letter before the enrollment deadline.
• Regularly review your financial account statements and credit reports for unfamiliar activity.
• Consider placing a fraud alert or credit freeze with the three major credit bureaus.
• Be cautious of unsolicited calls, texts, or emails referencing this breach, which may be phishing attempts.

File a Data Breach Lawsuit Against AVL Growth Partners

If you received a notification letter from AVL Growth Partners or believe your information may have been involved in this event, you may have legal options available to you.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.