Onward Research, doing business as Onward Consulting Corp., has notified customers of a cybersecurity incident that may have exposed their personal and financial information. The company discovered unauthorized activity on its website after an attacker gained access and created a hidden administrator account, allowing malicious software to be installed without detection. Companies that collect payment and contact information from customers online have a responsibility to secure that data against exactly this kind of intrusion, and when they fail to do so, the people whose information is exposed are the ones left to deal with the fallout.
Onward Research’s Data Breach Investigation
An investigation is underway into a cybersecurity incident affecting Onward Research, an online business operating as Onward Consulting Corp. According to a notice filed with the Massachusetts Attorney General’s office, an unauthorized third party gained access to the company’s website, onwardresearch.com, and used that access to create an administrator account and install hidden malicious software. This software altered the website’s normal operations, and as a result certain customer information — including transaction records not typically retained by the company — may have been viewed or copied by the intruder.
Onward Research says it identified the unauthorized activity and worked to remove the malicious software and restore normal website functionality. The company has engaged outside legal counsel and cybersecurity experts to determine the full scope of the incident, and that investigation remains ongoing as of the notice’s filing. Onward Research also reports that it deactivated any account passwords it had reason to believe were compromised, requiring those users to reset their credentials the next time they log in.
Incidents like this one illustrate a persistent risk for any company that stores customer payment details online: once an attacker gains administrative control of a website, they can often move freely through connected systems, harvesting whatever data passes through checkout forms, account pages, or stored transaction logs. Victims typically have no way of knowing their information was exposed until a company like Onward Research sends formal notice, often weeks or months after the actual intrusion occurred. That delay matters, because the longer stolen data sits unused, the harder it can be to trace fraudulent charges or new accounts back to a single source.
Data breach notification laws exist precisely so that consumers are not left in the dark. Companies that collect sensitive information, including full names, physical addresses, email addresses, and credit card numbers, are generally required to disclose a breach within a specific window once it is discovered and confirmed, though timelines vary by state. Attorneys who track these filings work to make sure that companies are living up to those obligations, and that affected consumers are not just notified, but given real information about what happened and what protective steps are actually necessary. As Onward Research’s investigation continues, it remains possible that additional details about the scope of the breach, or additional affected individuals, could come to light.
When Did This Breach Occur?
Onward Research states that it discovered the unauthorized access to its website on August 7, 2026. The company has not publicly disclosed how long the intruder may have had access to the site before detection, and the investigation into the full timeline of the incident is described as ongoing.
What Information Was Breached?
Based on Onward Research’s notice, the information that may have been exposed includes customer names, addresses, email addresses, and credit card information. The notice also states that certain transaction records not normally collected or retained by the company were potentially exposed as a result of the intrusion. Onward Research has not indicated any confirmed misuse of this information as of the date of its notice.
What You Can Do
If you received a data breach notice from Onward Research, or believe you may have been affected, there are several steps you can take to help protect yourself:
- Monitor your credit card and bank statements closely for any unauthorized or unfamiliar charges.
- Consider placing a fraud alert or credit freeze on your credit file with Equifax, Experian, and TransUnion.
- Review your free annual credit reports at annualcreditreport.com for signs of unfamiliar accounts.
- Be cautious of unsolicited emails, calls, or texts referencing this incident, which could be phishing attempts.
- Report any suspected fraud or identity theft to your state Attorney General and local law enforcement.
File a Data Breach Lawsuit Against Onward Research
If you were notified that your personal or financial information may have been compromised in the Onward Research data breach, you may be entitled to compensation. Companies that fail to adequately secure customer data can be held accountable for the harm that results.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
