Alcott HR data breach: Social Security numbers and dates of birth, notified 16 months on

Why did I get a letter from Alcott HR?

The letter gives one reason: Alcott may have received your data if you, or a person related to you, took part in Alcott's program. It does not say what the program is. A relative's link to the program can be enough to put someone in the files. The guide to letters from companies you never dealt with explains how a service firm comes to hold data on people who never contacted it.

What happened at Alcott HR?

Alcott says it put its incident response plan into action when it noticed the activity. It reported the matter to law enforcement and brought in independent computer forensic experts. The investigation found that an unauthorized user had got into some systems holding personal information. In March 2026, Alcott finished reviewing the data and determined whose had potentially been accessed.

The letter rules one system out. It says Alcott's human capital management platform, iSolved, which holds employee tax forms, benefits enrolment and banking information, was not affected. It also says Alcott took steps to keep any personal information from being released publicly, without saying what those steps were. The letter does not say how the user got in or whether files were copied, and it names no group.

Date	What happened	Source
February 12, 2025	Breach date in California's and Indiana's records	California and Indiana records
February 2025	Alcott notices unusual activity	Letter
March 2026	Review of the data completed	Letter
June 15, 2026	Letter date	Letter
June 17, 2026	Notice date in Indiana's record	Indiana record

California's record gives February 12, 2025 as the date of the breach. The letter is dated 488 days after that, about 16 months, and most of the gap was the review, which ended in March 2026. The guide to how long companies take to notify compares that with other letters in this log.

What information was in the Alcott HR breach?

The filed letter names the data instead of leaving a blank: your name with your Social Security number and date of birth.

Data type	In the letter
Name	Yes
Social Security number	Yes
Date of birth	Yes
Tax forms, benefits and banking details on iSolved	Not affected, the letter says

The letter says there is no evidence that any of the information has been used for a malicious purpose. The letter still advises watching financial account statements and credit reports for fraudulent or irregular activity.

How many people were affected by the Alcott HR breach?

Indiana gives the only count: 76,098 people in total, 167 of them Indiana residents. No Texas or Washington report for Alcott HR was found on those states' lists on November 10, 2026.

Record	People counted
Indiana attorney general, total	76,098
Indiana residents	167

The ranking of 2026 breaches by people affected shows where the Indiana total falls.

What is Alcott HR offering?

Twenty-four months of identity theft protection through Cyberscout, a TransUnion company, which the letter says will help resolve problems if a reader's identity is compromised. Enrolment in the credit monitoring was at bfs.cyberscout.com/activate with the code in the letter, within 90 days of the letter date. Counting from June 15, 2026, that window closed in September 2026. The guide to credit-monitoring offers compares this offer with others in this log.

The letter lists what Alcott changed afterwards: vendor support and security, threat detection and endpoint monitoring, firewalls, a third-party review of its configuration, and its password and multifactor authentication policies.

Was my information in the Alcott HR data breach?

If you received a letter from Alcott dated June 15, 2026, from a Cyberscout P.O. box in Suwanee, Georgia, your data was potentially accessed. The letter's question line is 1-844-507-4934, Monday to Friday, 8 a.m. to 8 p.m. Eastern Standard Time. If someone in your family took part in Alcott's program, the letter may have been addressed to you because of them.

What the notice leaves open

• What Alcott's program is, and how readers or their relatives were connected to it.
• How the unauthorized user got in, and whether files were copied.
• What steps Alcott took to keep the data from being released.
• Why the review took until March 2026.