New York City Regional Center, LLC (NYCRC), a USCIS-designated regional center that facilitates foreign investment in New York City real estate projects through the federal EB-5 Immigrant Investor Program, recently notified certain individuals of a cybersecurity incident that may have exposed some of their personal information. The company is offering two years of complimentary credit monitoring and fraud assistance services through Kroll to those affected.
Organizations that manage sensitive financial and identifying information on behalf of investors and clients have a responsibility to protect that data with reasonable security measures. When that protection fails, the individuals whose information is compromised can face lasting exposure to fraud and identity theft.
New York City Regional Center’s Data Breach Investigation
According to a notification letter filed with the Massachusetts Attorney General’s Office, New York City Regional Center, LLC identified a cybersecurity incident that may have involved unauthorized access to certain personal information. Massachusetts law restricts the level of detail a company can include in an individual notification letter, so NYCRC’s letter does not specify precisely how the incident occurred, when it was first discovered, or how many individuals nationwide were affected. The company is providing two years of complimentary Single Bureau Credit Monitoring, fraud consultation, and identity theft restoration services through Kroll, a firm that specializes in risk mitigation and data incident response.
NYCRC, which was the first EB-5 regional center approved in New York City after receiving USCIS designation in 2008, has facilitated more than $1.5 billion in foreign investment capital tied to major real estate developments, including studio and production facilities. As an entity that manages investor applications, financial records, and immigration-related documentation, NYCRC and similar regional centers routinely handle highly sensitive personal information, including Social Security numbers, financial account details, and identification documents submitted by investors as part of the EB-5 application process. This type of concentrated, high-value personal and financial data makes investment and immigration-services firms an attractive target for cybercriminals.
Data breach notification laws generally require a company to notify affected individuals and relevant state authorities once it determines that personal information was, or is reasonably believed to have been, accessed without authorization. Investigating the scope of a cybersecurity incident, identifying every individual whose data may have been affected, and coordinating with a notification and monitoring vendor like Kroll is a process that can extend for weeks or months following the initial detection of suspicious activity.
When financial and identifying information is exposed in an incident like this, affected individuals can face an elevated risk of identity theft, unauthorized new account openings, and fraudulent activity that may not surface immediately. Because compromised data is often used gradually and unpredictably by bad actors, security professionals recommend that individuals remain vigilant well beyond any complimentary monitoring period provided by the company responsible for the breach.
Individuals who received a notification letter from NYCRC, or who believe they may have been affected but have not yet received formal notice, are encouraged to review the protective steps below and consult with a qualified attorney about their legal options.
When Did This Breach Occur?
NYCRC’s notification letters were filed with the Massachusetts Attorney General’s Office in early August 2026. The letter does not publicly disclose the specific date the underlying cybersecurity incident occurred or was first discovered. This page will be updated if additional details become publicly available.
What Information Was Breached?
The publicly filed version of NYCRC’s notification letter does not specify, for the general population of recipients, which categories of personal information were involved. Given the nature of the EB-5 investment application process, potentially affected information may include names, Social Security numbers, and other identifying or financial information submitted by investors, though NYCRC has not publicly confirmed the specific data types affected by this particular incident. This page will be updated if NYCRC releases additional information about the scope of information involved.
What You Can Do
If you received a notification letter from New York City Regional Center, consider taking the following steps to help protect yourself:
- Activate the complimentary Kroll identity monitoring services referenced in your notification letter before the stated deadline.
- Regularly review your bank and investment account statements for unfamiliar activity.
- Request a free copy of your credit report from each of the three major credit bureaus at annualcreditreport.com.
- Consider placing a fraud alert or credit freeze on your credit file with Equifax, Experian, and TransUnion.
- Report any signs of identity theft to your local police department and the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against New York City Regional Center
If you received a notice that your personal information may have been compromised in the New York City Regional Center data breach, you may have legal options available to you. Companies that collect sensitive investor and financial information are expected to implement reasonable safeguards to protect it, and affected individuals may be entitled to compensation for the risks they now face.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
