Fourthline Capital Management, LLC, a commercial real estate investment firm based in Washington, D.C., has notified people that their personal information was contained in an email account that someone accessed without authorization. This page summarizes what the company’s notice letter says.
Fourthline Capital Management’s Data Breach Investigation
Fourthline Capital Management, LLC sent a notice letter dated October 29, 2026, telling recipients about a recent incident that may have involved some of their personal information. A sample of the letter was filed with Massachusetts regulators, and Massachusetts breach records list 2 Massachusetts residents. The company has not published a total number of people affected across all states, so the full reach of the incident is not publicly known.
According to the letter, the company discovered on May 26, 2026 that someone had gained unauthorized access to a single account in its email environment, and that the access lasted from May 20, 2026 to May 26, 2026. The company says it secured the affected account right away, reset credentials, enhanced its existing security measures and notified law enforcement. It also began an investigation to understand what had happened.
Rather than a quick lookup, the company describes a slow, detailed review of the contents of the affected mailbox to work out what personal information was stored there. That review ended on August 20, 2026, when the company determined that some people’s information may have been affected. The letter reached recipients roughly two months after that, which is worth keeping in mind if you are trying to understand how long information may have been exposed before you were told.
The filed sample says the affected information contained the recipient’s name together with certain other details, but the list of those other details is blank in the copy on file. The sample is a template, and the specific items printed in individual letters were left out. For that reason the exact categories of data involved are not publicly known, and this page does not guess at them. Your own letter is the best guide to what applies to you.
The company states that it has no evidence or indication of actual or attempted misuse of the information involved. That is a statement about what the company has seen so far, not a guarantee. Information taken from an email account can be held and used long after an incident ends, so many people choose to stay alert for a long time after receiving a notice like this one.
As a precaution, Fourthline Capital Management is offering 24 months of credit monitoring and identity restoration services at no charge through Cyberscout, a TransUnion company. The services include single-bureau credit monitoring, a single-bureau credit report and score, and proactive fraud assistance. Recipients must sign up themselves using the unique code in their letter, and they must enroll within 90 days of the date of the letter. A dedicated help line is available for questions during that period.
According to its website, Fourthline Capital Management invests in commercial real estate, including multifamily, industrial, mixed-use, hospitality and retail properties, with a focus on markets in the Southeast and Mid-Atlantic. A firm of that kind communicates with investors, business partners, lenders and advisors, and email accounts often hold attachments such as tax forms, account statements and identity documents. The letter does not say which group of people the notice covers, or what any individual’s connection to the company was.
Email compromises are among the most common ways personal information is exposed. A single account can hold years of messages and files, and the people who sent or received them may have no idea their details are sitting in that mailbox. Attackers often reach an account through a stolen or guessed password, or through a deceptive message that tricks the account holder into signing in on a fake page. The letter does not say how access was obtained here, and it would be a mistake to assume.
Companies that hold personal information are expected to protect it with reasonable safeguards, and state laws require them to notify the people affected. Attorneys are looking into whether Fourthline Capital Management took reasonable steps to protect the information involved and whether its notice came as quickly as the circumstances allowed. The filed letter is a sample, so it does not show how many people received it or exactly when each state’s notice was sent.
When Did This Breach Occur?
According to the notice letter, someone had unauthorized access to one email account from May 20, 2026 to May 26, 2026. The company discovered the access on May 26, 2026, and on August 20, 2026 it determined that some individuals’ information may have been impacted. The letter itself is dated October 29, 2026. Recipients have 90 days from the date of the letter to enroll in the monitoring services offered.
What Information Was Breached?
The letter says the affected email account contained the recipient’s name together with certain other information, but the list of other information types is blank in the sample filed with Massachusetts regulators. The categories involved have therefore not been publicly disclosed, and they may differ from person to person. The company says it has no evidence of attempted or actual misuse of the information.
What You Can Do
If you received a notice related to Fourthline Capital Management or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Use the unique code in your letter to enroll in the 24 months of Cyberscout monitoring within 90 days of the letter date, and call the help line printed in the letter if you have questions.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Fourthline Capital Management
If you received a notice from Fourthline Capital Management, LLC, or you believe your personal information was in the affected email account, you may have legal options for holding the company accountable for how it protected your data.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
