Acumetis (HC Parent Holdings LLC, d/b/a Acumetis | SixSense Strategy Group) has sent a notice to individuals about a security incident that involved some of their information. The letter was filed with Massachusetts regulators, and few details have been made public.
Acumetis’s Data Breach Investigation
HC Parent Holdings LLC, which does business as Acumetis | SixSense Strategy Group and refers to itself as Acumetis in its notice, has told people that an incident involved some of their personal information. The company is located in Yardley, Pennsylvania. A sample of its notice letter, dated October 26, 2026, was filed with the Massachusetts Office of Consumer Affairs and Business Regulation and is publicly posted on the state’s website.
The letter is short on specifics. It says only that the incident involved some of the recipient’s information and that Massachusetts law prevents the company from providing additional details about the event. State rules in Massachusetts bar a notice from describing the nature of the incident, which is why letters filed there often read as brief and general even when the underlying event was serious. Anyone who received this notice should keep in mind that more detail may exist in the versions mailed to residents of other states.
According to the letter, Acumetis took immediate steps to secure its network and to strengthen its security posture once it discovered the incident. The notice does not say how an unauthorized person may have gotten in, when the activity started or ended, how long it went undetected, or whether files were copied or only viewed. It also does not say how many people received the letter, and no total has been published in the sources reviewed for this page.
The letter states that the information that could have been impacted includes the recipient’s name together with other types of information. The list of those other data types is left as a blank merge field in the filed sample, so it is not possible to say from the public document which categories were involved for any given person. Acumetis has therefore not publicly confirmed whether Social Security numbers, financial account details, health information or other sensitive records were part of the incident.
Acumetis is offering complimentary credit monitoring and identity restoration services through IDX for 24 months. The letter makes clear that recipients must enroll themselves, because the company cannot enroll anyone on their behalf, and that the enrollment deadline is January 26, 2027. The letter also directs people to activate the credit monitoring included in the IDX membership, noting that it must be activated to be effective and that a person needs established credit and internet access to use it.
The notice repeats standard guidance for anyone whose information may be at risk. It encourages people to review account statements, monitor free credit reports for suspicious activity, and watch for errors over the following one to two years. It also encourages reporting any suspected identity theft or fraud to a bank or card company, and recommends changing the password promptly if a username and password for an account were affected.
Notices of this kind often leave open important questions, and it is common for a company to release more information later through additional state filings or updates to affected individuals. Organizations that hold personal information for business clients or customers are frequent targets for criminals who seek names, contact details and identifying numbers that can be used in fraud. Even when a letter lists only a person’s name, a name combined with other data can be enough for phishing messages that sound convincing.
People who received a letter from Acumetis should keep it, since it carries the enrollment code and the deadline for the IDX services. Anyone who did not receive a letter but has dealt with the company, as an employee, client, job candidate or in some other role, may want to watch their mail and email for a notice in the coming weeks. Attorneys are looking into whether Acumetis took reasonable steps to protect the information it held and whether its handling of the incident met the standards that apply to companies that store personal data.
When Did This Breach Occur?
The notice filed with Massachusetts does not say when the incident happened or when Acumetis discovered it. The letter is dated October 26, 2026, which is the date the company began communicating with affected individuals. Acumetis says it acted immediately after discovering the incident to secure its network, but it has not published a timeline of when unauthorized access began, when it was found or when it ended. Until the company or a regulator provides dates, the timing of the incident should be treated as unknown.
What Information Was Breached?
The letter says the information that could have been impacted includes a person’s name along with additional types of information, but the filed sample does not fill in what those other types are. Acumetis has not publicly confirmed a specific list of data elements and no total number of affected people has been reported. Because the company is offering identity restoration and credit monitoring, people who receive the letter should assume that sensitive details could be at risk until they learn otherwise.
What You Can Do
If you received a notice related to Acumetis or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the complimentary IDX credit monitoring and identity restoration before the January 26, 2027 deadline, and activate the monitoring after you sign up, since it must be activated to work.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Acumetis
If you received a notice from Acumetis, or you believe your information was involved, you may have legal options for holding the company accountable for how it protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
