Lotus Infrastructure Global Operations, LLC has notified people that data it gave to its accounting firm may have been accessed in an attack on that firm’s platform.
Here is what the company’s letter says and what you can do if you received one.
Lotus Infrastructure Global Operations, LLC’s Data Breach Investigation
Lotus Infrastructure Global Operations, LLC, which its letter calls LIGO, is a company that works with the Lotus Infrastructure Partners group. This page is based on a notification letter the company filed with the Massachusetts state government, which publishes breach notification letters on a public list. The letter is dated October 1, 2026, and it is signed in the name of Lotus Infrastructure Partners.
The letter explains that LIGO engages the accounting firm Ernst and Young LLP, which it calls EY, to provide professional services. As part of that work, EY obtained certain information from LIGO. According to the letter, between March 28 and April 12, 2026, an unauthorized person accessed EY’s management platform. The letter says that only EY’s platform was accessed and that the person did not get into LIGO’s own computer systems.
The letter then lays out a sequence of dates. On August 6, 2026, EY determined that data files it had obtained from LIGO were affected, and that some of those files included personal and financial information for certain individuals. On August 7, 2026, EY told LIGO in general terms that some of the affected files held such information. Between August 31 and September 2, 2026, EY gave LIGO specific information showing that the recipient’s information was in the affected files.
The letter says EY told LIGO about the steps it took after learning of the incident. These included starting its incident-response process to contain the unauthorized access and remediate the platform, confirming that access to the credential the unauthorized person used had been revoked, starting a technical investigation into the nature and extent of the access and confirming the attack had been contained, and carrying out a forensic investigation of the data that might have been exposed.
LIGO says it is conducting its own investigation and asking EY for more information about what happened, how it happened and what EY will do to protect data going forward. It also says it will review its policies and procedures for vendors, to make sure they use reasonable safeguards for any data the company provides them. Those are the company’s own statements, and this page repeats them as such.
The letter does not say how many people were affected, and this page does not estimate a number. It does not say how the unauthorized person got into EY’s platform, and it does not say whether any ransom or extortion demand was made. The same EY platform incident has been the subject of separate public reporting involving other EY clients, but those reports concern different notices, and none of their details are attributed to LIGO here.
The timeline is worth reading closely. The access happened between March 28 and April 12, 2026, EY did not determine that LIGO’s files were affected until August 6, 2026, and specific individual information reached LIGO between August 31 and September 2, 2026. The letter to affected people is dated October 1, 2026. That means roughly six months passed between the access and the date on the letter, which is a reasonable thing for an affected person to ask about when calling the assistance line.
The letter says the company has secured credit monitoring services for affected people through a service called Financial Shield. It describes one-bureau credit monitoring for 36 months, $1,000,000 of identity theft insurance, bank and financial account monitoring, financial transaction monitoring, address change and home title monitoring, access to a call center and customer support, including remediation help if identity theft is suspected. People must enroll by December 30, 2026, after which the activation code will no longer work.
The letter also notes that people may request a security freeze at no cost from Equifax, Experian or TransUnion, and it lists the mailing addresses and telephone numbers for those agencies and for the Federal Trade Commission. A call center number for questions about the incident and about enrolling is listed in the letter. If you are unsure whether a message about this incident is genuine, contact the company through details published on its own website rather than details in an unexpected message.
When Did This Breach Occur?
The letter says an unauthorized person accessed EY’s management platform between March 28 and April 12, 2026.
EY determined on August 6, 2026 that files it had obtained from the company were affected. The company’s letter to affected people is dated October 1, 2026.
What Information Was Breached?
According to the letter, the information that might have been accessed includes a person’s name, an address and a Social Security number.
The letter describes the files as containing personal and financial information for certain individuals. Your own letter should confirm what applies to you.
What You Can Do
If you received a notice related to Lotus Infrastructure Global Operations, LLC or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the complimentary 36-month Financial Shield monitoring by December 30, 2026, using the activation code in your letter.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Lotus Infrastructure Global Operations, LLC
If your personal information was exposed in this incident, you may have legal options. Organizations are expected to protect the sensitive information they are trusted with, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
