iCapital, formally Institutional Capital Network, Inc., has sent a notice about a data security incident involving a file of investor data. This page summarizes what its notice letter and the Massachusetts breach report say so far.
Institutional Capital Network, Inc.’s Data Breach Investigation
Institutional Capital Network, Inc., which calls itself iCapital in its notice and is based at 60 East 42nd Street in New York, has told investors about a data security incident. Its notice letter is dated October 22, 2026, and a sample was filed with the Massachusetts Office of Consumer Affairs and Business Regulation and posted on the state’s website. The state’s 2026 breach report lists the incident as reported on October 22, 2026, and records it as involving 3 Massachusetts residents.
The letter describes an accidental disclosure and not an outside attack. It says that on September 24, 2026, iCapital learned that an employee had inadvertently shared a file containing investor data with an unauthorized recipient earlier that same day. The company describes the recipient as a reputable fund administrator that is bound by confidentiality obligations about information it receives from iCapital but was not authorized to see this information in this particular context.
According to the letter, the recipient promptly and in good faith told iCapital it had received information that was not intended for it. The recipient also confirmed that it deleted the file right away, did not keep any copies of the file or its contents, and did not use the information for any unauthorized purpose. Those statements come from iCapital’s own letter, and no independent verification of them has been published.
After reviewing the data, iCapital determined that the file contained each affected person’s name, account number and tax ID number, which the letter says may be a Social Security number. The Massachusetts breach report is consistent with that description: it flags Social Security numbers and financial account information as breached, and does not flag medical records, driver’s license numbers or card numbers.
No total number of affected people has been published. The count of 3 covers only Massachusetts residents, and iCapital, which works with investors and financial professionals, may have sent notices to people in other states as well. The company has not said how many individuals were listed in the shared file, which fund administrator received it, or what the file was being used for at the time.
Out of an abundance of caution, iCapital is offering 24 months of complimentary identity protection services through Cyberscout, a TransUnion company. The letter says these services help detect possible misuse of information and provide identity protection support, and that recipients can enroll through a website using a unique code printed in the mailed letter. Enrollment is limited to adults. The letter also encourages people to stay alert for phishing emails and invites questions by email to the company’s data protection office.
This is not the first time iCapital has told people about an accidental disclosure of this type. Public Massachusetts records show an earlier notice in which iCapital said that on November 18, 2024 it inadvertently gave an unrelated third party access to a file containing a person’s name, address and tax ID. That earlier event is a separate incident, and this page does not attribute its details to the 2026 incident, but a second notice involving similar data raises fair questions about the company’s controls for handling investor files.
Names paired with account numbers and tax IDs are sensitive in the hands of a stranger, even when the recipient says it deleted the file. A tax ID that is also a Social Security number can be used to open credit accounts, file false returns or pass identity checks, and an account number can help in efforts to impersonate an investor to a financial firm. If you received a letter from iCapital, keep it and consider the free credit freeze and fraud alert options below. Attorneys are looking into whether iCapital took reasonable steps to protect investor information and whether its notice met the standards that apply.
When Did This Breach Occur?
iCapital says the file was shared on September 24, 2026 and that it learned of the disclosure that same day. Its notice letter to affected people is dated October 22, 2026, which is also the date the incident appears as reported in the Massachusetts breach report, about four weeks after the company learned of it. The company has not described any earlier or later period of exposure.
What Information Was Breached?
According to the notice, the shared file contained each affected person’s name, account number and tax ID number, which may be a Social Security number. The Massachusetts breach report flags Social Security numbers and financial account information and does not flag medical records, driver’s license numbers or card numbers. The company says the recipient deleted the file and did not use the information.
What You Can Do
If you received a notice related to Institutional Capital Network, Inc. or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24 months of Cyberscout identity protection offered in the letter, using the unique code printed in your copy.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Institutional Capital Network, Inc.
If you received a notice from iCapital, or you believe your information was in the shared file, you may have legal options for holding the company accountable for how it protected your tax ID, account number and other sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
