National Insurance Company is named in a data breach notification filed with Massachusetts regulators and posted in the state’s list of notification letters for October 2026. The letter was issued by the law firm Squire Patton Boggs (US) LLP, which says it held the personal information on behalf of a client.
If you received this notice, here is what has been made public so far and what you can do about it.
National Insurance Company’s Data Breach Investigation
The notice at the center of this page is signed by Squire Patton Boggs (US) LLP, a law firm. It describes a recent cybersecurity incident involving personal information the firm held on behalf of a client. The state lists the filing under the name National Insurance Company. The portion of the letter we reviewed does not spell out the relationship between the client and the insurer, so this page does not describe it beyond what the state listing and the letter show side by side.
The letter says the firm confirmed on September 25, 2026 that sensitive personal information was contained within the impacted files, and that it also confirmed the addresses of the individuals affected. That sequence matters. A confirmation date is usually the point at which a review of the affected files was finished and mailing addresses were matched, not the date the incident began. The letter, as we read it, does not state when unauthorized access started, how long it lasted, or how the files were reached.
According to the letter, the personal information involved in the incident was obtained through the course of providing legal services to one or more clients. That is a notable detail for anyone who is not a client of the firm. People who never dealt with a law firm directly can still have their information held by one, because insurers, employers and other organizations routinely send records to outside counsel for claims handling, disputes and compliance work. A notice from a law firm can therefore come as a surprise to a person who has never heard of it.
The firm says it launched an investigation, contacted law enforcement and regulators, and added security controls, system monitoring and detection capabilities as a precaution against a similar intrusion. It is also offering complimentary identity theft and credit monitoring services through Epiq to people who received the letter, with enrollment instructions and an activation code included in the notice. The letter points readers to a reference guide that explains fraud alerts and security freezes and includes guidance from the Federal Trade Commission.
What the notice does not give is a total. We did not find the number of people affected in the Massachusetts listing or in a press statement. This page therefore does not state a count of affected individuals, and it does not guess at one. Notices of this kind are often sent to people in many states at once, and each state regulator that requires a filing receives its own report, so a single state listing can understate the full scope.
Law firms hold a large amount of sensitive material because of the work they do. Client files can include identifiers, account numbers, medical or financial records and correspondence, often copied from several outside sources. That concentration is one reason law firms and other professional service providers are attractive targets for attackers. We are describing the general landscape only. The letter does not say who was responsible for this incident or whether any of the information has been misused.
Squire Patton Boggs has been the subject of a separate page on this site, based on its own notice. This page covers the filing listed under National Insurance Company and should be read on its own terms.
If you received a letter, read it closely and keep a copy. It is the best source for what applies to you, including which items of your information were involved and how to use the monitoring offer. If you think you may be affected but did not receive anything, you can contact the firm or the company named in the state listing to ask whether your information was involved.
When Did This Breach Occur?
The letter states that on September 25, 2026 the firm confirmed that sensitive personal information was contained within the impacted files and confirmed the addresses of impacted individuals.
That is the only date the letter gives. It does not say when the incident itself began or ended, and it does not state a mailing date. A confirmation date can fall well after the underlying event, so it should not be read as the date your information was exposed.
What Information Was Breached?
The letter says the impacted information included names, Social Security numbers and insurance account numbers, and in some instances dates of birth.
Social Security numbers are among the most sensitive identifiers a person has. Unlike a password, a Social Security number cannot be easily changed, and it stays useful to criminals for years. Combined with a name and date of birth, it can be used to open credit accounts in someone else’s name, file false tax returns or pass identity checks. An insurance account number adds a risk of fraudulent claims or account takeover. Not everyone received the same set of items, since dates of birth were involved only in some instances.
What You Can Do
If you received a notice from National Insurance Company or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Watch your financial accounts, tax records and any insurance or medical statements for activity you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the organization, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against National Insurance Company
If your personal information may have been exposed in this incident, you may have legal options. Organizations and the firms that handle their records are expected to safeguard sensitive information, and a class action can help hold them accountable when that fails.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
