Seclore, Inc., a Santa Clara, California company that sells data-centric security software, has told an undisclosed number of people that their names and Social Security numbers may have been accessed or acquired by an unauthorized party. The notice was filed with the Massachusetts Attorney General’s office as part of that state’s public breach-notification process.
Seclore’s Data Breach Investigation
Seclore, Inc. describes its business as protecting sensitive data for organizations, which makes any incident involving its own systems worth a close look. According to the notification letter the company filed with Massachusetts regulators, Seclore learned of a data security incident, secured its network right away, and began an investigation with outside cybersecurity professionals who handle incidents of this kind. After that investigation and a follow-up document review, the company concluded on July 22, 2026 that, on March 4, 2026, a limited amount of personal information may have been subject to unauthorized access or acquisition.
The wording in the letter is cautious. Seclore says information “may have been” accessed or acquired rather than confirming exactly what was taken, and it states that it has no evidence of financial fraud or identity theft connected to the incident. The letter does not explain how the unauthorized party got in, does not say whether the activity was ransomware, phishing, or something else, and does not identify which group of people, such as employees, former employees, customers, or business contacts, received the notice. The copy on file with the state is a sample letter with the recipient’s name and the activation code left blank, so the filing itself does not reveal how many letters went out.
Seclore has not published a total number of affected individuals. Massachusetts posts the letters it receives on its public list of data breach notifications, but the posted version is the template, not a tally. Until the company or another regulator publishes a figure, the scale of the incident remains unknown, and we are not estimating one here.
Why does the gap between the incident and the notice matter? Many states require companies to notify residents within a set period after they determine that personal information was involved, and some require notice to the state attorney general as well. A company often needs time to work out which files were touched and who is named in them, which is why the final determination can come well after the original event. The stretch between an event and the moment a person finds out that their data was involved is also the period during which stolen information can be misused without the person knowing, which is one reason prompt review of financial accounts and credit reports is the standard advice in these notices.
The kind of data involved also shapes the risk. A name paired with a Social Security number is the foundation of most identity theft. A Social Security number is difficult to change, remains attached to a person for life, and can be used to open accounts, file false tax returns, or apply for credit in someone else’s name. Unlike a payment card number, it cannot simply be cancelled and reissued. That is why even an incident described as limited can matter to the individuals on the list, and why regulators encourage anyone who receives a letter like this one to take the protective steps it describes.
Seclore says it has taken precautions to safeguard personal information and that it continually evaluates its practices and internal controls to improve the security and privacy of the data it holds. The company is offering affected individuals complimentary credit monitoring, a credit report, a credit score, and proactive fraud assistance through Cyberscout, a TransUnion company. Those services are free to enroll in and, according to the letter, enrolling will not hurt a person’s credit score.
If you received a letter from Seclore, keep it, since it contains the activation information you need for the monitoring services. If you did not receive one but think your information could have been involved because you have worked with or for the company, watch your mail and your accounts, and consider contacting Seclore directly to ask whether your information was included. This page will be updated if Seclore or a regulator publishes additional details about the incident, such as the cause or the number of people affected.
When Did This Breach Occur?
According to the notification letter, the unauthorized access or acquisition took place on March 4, 2026. Seclore says it determined on July 22, 2026 that personal information may have been involved, after an investigation and a document review. That means a stretch of several months passed between the incident and the company reaching its conclusion about whose information was in the affected files.
The letter on file does not show the date it was mailed, because the date line is not included in the copy posted with the state filing. It also does not say when Seclore first discovered the incident, only that it learned of it, secured its network, and then began investigating. The dates above are the only ones the company has disclosed.
What Information Was Breached?
Seclore states that the personal information potentially affected includes each person’s name and Social Security number. The letter describes the exposure as a limited amount of personal information and does not list any other categories, such as dates of birth, addresses, financial account numbers, or medical information.
Because the filed letter is a template, it is possible that the exact mix of data differs from person to person. The company has not said so, and we are not assuming it. If your letter lists anything beyond a name and Social Security number, rely on the letter.
What You Can Do
Enroll in the complimentary credit monitoring, credit report, and credit score services using the activation information in your letter. The services come through Cyberscout, a TransUnion company, and enrolling is free.
Review your financial account statements and credit reports regularly for anything you do not recognize. Federal law entitles you to a free credit report from each of the three nationwide credit bureaus on a recurring basis through annualcreditreport.com.
Consider placing a fraud alert on your credit files, which is free and asks lenders to contact you before opening new accounts. For stronger protection, you can place a security freeze with Equifax, Experian, and TransUnion at no charge. If you plan to enroll in the monitoring services, the letter notes that a freeze may need to be lifted first.
If you believe your information has been misused, file a report with local law enforcement and a complaint with the Federal Trade Commission at ftc.gov/idtheft. Massachusetts residents have the right to obtain a police report about this incident.
File a Data Breach Lawsuit Against Seclore
When a company that holds Social Security numbers has an incident that exposes them, people sometimes have legal options, including joining a class action to seek compensation for the time, risk, and costs the exposure creates. Whether a claim is viable depends on facts that are not yet public in this case, such as how the unauthorized party got access and how many people were affected.
Class Action U can connect you with a lawyer who handles data breach cases. Speaking with a lawyer does not commit you to anything.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
