ISS Management and Finance Co, Inc has notified people of a data security incident that it describes as an inadvertent disclosure of their personal information. This page summarizes what the company’s notice letter says.
ISS Management and Finance Co, Inc’s Data Breach Investigation
ISS Management and Finance Co, Inc sent a notice dated October 28, 2026, titled Notice of Data Security Incident. The letter tells recipients that the company is writing about the inadvertent disclosure of their personal information. A sample of the letter was filed with Massachusetts regulators, and Massachusetts breach records list 1 Massachusetts resident. The company has not published a total number of people affected across all states.
The letter says that, at the time it was written, there was no evidence of any attempt to misuse any of the personal information involved. It does not say how the disclosure happened, who received the information, what systems or files were involved, or when the disclosure took place or was discovered. The phrase inadvertent disclosure usually points to information being sent or exposed unintentionally, but the letter does not explain which of those occurred here.
The sample filed with the state does not list the types of personal information involved. The letter describes the information only as personal information, and it refers to the personal nature of the information at issue. Because no categories are named, this page cannot say whether Social Security numbers, financial details, health information or something else was involved, and it does not guess.
To help recipients, the company is offering identity theft protection through IDX. The letter describes 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery services. Recipients must enroll by January 28, 2027, using the enrollment code printed on their own letter, either through the IDX website, by scanning the QR code in the letter or by calling the number it provides.
Because the letter includes Massachusetts-specific language, it also reminds recipients of their rights under state law. Those include the right to obtain a copy of any police report filed about the incident, the right to file a police report if they become a victim of identity theft, and the right to place a security freeze on their credit reports free of charge. The letter lists the mailing addresses and phone numbers for placing a freeze with Equifax, Experian and TransUnion.
A security freeze prevents a credit bureau from releasing information from your credit report without your written authorization, which makes it harder for someone to open new accounts in your name. The letter notes that a freeze may delay or interfere with the timely approval of new loans, credit, mortgages, employment or housing, so people who plan to apply for any of those usually lift the freeze temporarily. Federal law bars the bureaus from charging a fee to place, lift or remove a freeze.
The letter also recommends reviewing account statements and credit reports regularly. Under federal law, you can get one free credit report every 12 months from each of the three major credit reporting companies at annualcreditreport.com, and the letter suggests staggering requests so that you receive a report from a different bureau about every four months. If you discover suspicious items and have enrolled in the IDX service, the letter says to notify IDX right away.
Organizations that hold personal information are expected to protect it with reasonable safeguards, and state laws require them to notify affected people. Attorneys are looking into whether the company took reasonable steps to protect the information involved and whether its notice met the standards that apply. The filed letter is a sample, so it does not show how many people received it, what information each person’s letter describes, or exactly when each state’s notice was sent.
When Did This Breach Occur?
The letter is dated October 28, 2026, but it does not say when the disclosure occurred or when the company found out about it. No timeline has been published, so the timing of the underlying event should be treated as unknown for now. Recipients should note the enrollment deadline of January 28, 2027 for the identity protection services.
What Information Was Breached?
The sample letter filed with Massachusetts regulators does not name the categories of personal information involved. It refers only to the inadvertent disclosure of the recipient’s personal information. What applies to you may differ from person to person, and your own letter or a call to the company is the best way to learn which details were involved in your case.
What You Can Do
If you received a notice related to ISS Management and Finance Co, Inc or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24 months of IDX protection by January 28, 2027 using the code on your letter, and consider a free security freeze with each credit bureau.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against ISS Management and Finance Co, Inc
If you received a notice from ISS Management and Finance Co, Inc, or you believe your personal information was disclosed, you may have legal options for holding the company accountable for how it protected your data.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
