Office of Consumer Affairs and Business Regulation Data Breach

The Massachusetts Office of Consumer Affairs and Business Regulation (OCABR) has notified individuals that their personal and financial information was inadvertently disclosed in response to a public records request. Government agencies routinely handle records containing personal information, and even a single misdirected disclosure can expose people to a real risk of financial fraud.

Office of Consumer Affairs and Business Regulation’s Data Breach Investigation

According to OCABR’s notification letter, the agency became aware of the incident on or about July 27, 2026. The affected individuals had participated as arbitrators in OCABR’s home improvement contractor program, and their information was maintained in agency records connected to that program. In responding to a public records request from a Massachusetts attorney seeking a list of home improvement contractor arbitrators, OCABR inadvertently included account and routing numbers tied to a financial institution alongside the requested list.

Once OCABR identified the error, it contacted the attorney who received the records. The attorney confirmed he had not been aware the financial information was included, had not shared the document with anyone else, and would not do so going forward. OCABR also stated the attorney agreed to delete the original email and attachment, and the agency subsequently provided him with a corrected version of the record that omitted the financial account information. OCABR reported the incident to the Massachusetts Attorney General’s Office as required under M.G.L. c. 93H, the state’s data security law.

Incidents like this one illustrate a common but often overlooked category of data breach: unintentional disclosure during a routine administrative process such as fulfilling a public records request. Because public records requests can require compiling and cross-referencing multiple internal data sources, financial or otherwise sensitive fields can end up bundled with information that was actually intended to be public, particularly when the underlying records were not originally created with public release in mind.

Exposure of a name together with a bank account and routing number can enable a range of fraudulent activity, including unauthorized ACH withdrawals, fraudulent account-linking attempts, and social engineering attacks that use the leaked banking details to appear legitimate. Financial institutions can often flag or block unauthorized transactions once alerted, which is why prompt monitoring after a notice like this is important even when the recipient of the misdirected information has stated they did not misuse it.

OCABR’s response, notifying affected individuals, working with the recipient to confirm deletion, and reporting to the Attorney General, followed the general pattern required under Massachusetts breach notification law once financial account information tied to an identifiable person is exposed to an unauthorized third party, even briefly and even when that third party cooperates fully.

When Did This Breach Occur?

OCABR sent the public records response containing the financial account information on or about June 1, 2026. The agency states it became aware of the inadvertent disclosure on or about July 27, 2026, and sent notification letters to affected individuals on July 29, 2026.

What Information Was Breached?

OCABR’s review determined that the exposed records included each affected individual’s name in combination with financial account and bank routing numbers.

What You Can Do

OCABR recommends that affected individuals remain vigilant against identity theft and fraud by reviewing account statements and monitoring credit reports for unfamiliar activity. Consumers may also:

• Request a free credit report from Equifax, Experian, and TransUnion at annualcreditreport.com
• Place a fraud alert or a security freeze on their credit file at no cost
• Contact their bank to monitor the affected account for unauthorized transactions
• Obtain a police report if they believe they have been a victim of identity theft

File a Data Breach Lawsuit Against Office of Consumer Affairs and Business Regulation

Individuals whose names and financial account information were inadvertently disclosed by OCABR may have options for pursuing accountability and protection for the exposure of their sensitive data.

Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.