Boston Capital data breach: files copied in January 2026, letters in two waves

Date	Event
January 16 to 22, 2026	Files accessed and copied from Boston Capital's network
February 12, 2026	Boston Capital begins reviewing a claim of unauthorized access to its files
March 17, 2026	Notice about the matter posted on Boston Capital's website
May 5, 2026	Review finds New Hampshire residents' information in the files
May 18, 2026	First letters: Massachusetts (2,654) and New Hampshire (112)
August 27, 2026	Review completed for the second group of people
September 17, 2026	Second letters: 411 more New Hampshire residents; notification complete

What happened at Boston Capital?

The firm's counsel told New Hampshire that on February 12, 2026, Boston Capital began reviewing a claim involving possible unauthorized access to files on its network, and had cybersecurity specialists check that the network was secure. The investigation found the intrusion described above, and the files copied from January 16 to 22. The notice does not say who made the claim. The filings do not mention a ransom or a data leak.

The notice also says Boston Capital notified federal law enforcement. It published a notice on its website on March 17, 2026, while the file review was still running, two months before the first letters.

Who is Boston Capital?

Boston Capital was founded in 1974 and describes itself as an early player in affordable housing finance, having invested in 3,700 multifamily apartment properties in all 50 states. In December 2020 it sold substantially all of its low income housing tax credit portfolio and now focuses on debt financing through Boston Capital Finance and on asset management.

Why did some people get the letter in September?

Because the file review ran in stages. The first New Hampshire notice says the review found New Hampshire residents' information on May 5, and letters went to about 112 of them from May 18. The September letter tells its readers that the review of their information was complete on August 27, 2026. On September 17, the firm sent letters to about 411 more New Hampshire residents and told the state the notification process was complete. That puts eight months between the copying and the last letters. The Massachusetts list shows only the May report; any later Massachusetts letters are not in it.

Record	Residents	Data it marks
Massachusetts OCABR, report 2026-802 (May 18)	2,654	Social Security numbers, financial accounts
New Hampshire DOJ notice, May 18	112	Name, Social Security number
New Hampshire DOJ supplemental notice, September 17	411	Not listed in the notice
Two states	3,177

What information was exposed?

For New Hampshire residents in the first round, the notice lists name and Social Security number. Massachusetts marks Social Security numbers and financial account information. The September sample letter leaves the data field blank, to be filled in for each person. The Massachusetts letter says state law limits what it can share about the incident and points readers to the toll-free line, 1-833-877-7029, for more. None of the filings says whether the people affected are investors, tenants or staff.

What is Boston Capital offering?

Credit monitoring through Cyberscout, a TransUnion company. The New Hampshire notice gives twelve months. The Massachusetts letter gives alerts for twenty-four months from enrollment, at bfs.cyberscout.com/activate with the code in the letter. Since a Social Security number is involved, a credit freeze at the three bureaus is the stronger step. The credit monitoring guide compares the offers. For other Massachusetts reports this year, see the Massachusetts 2026 ranking, and for the timing, the notice delay guide.

What the documents leave open

• Who made the February 12 claim, and whether any files were published or a ransom demanded.
• Whose records the files held: investors, tenants, employees or others.
• The total notified across all states; only Massachusetts and New Hampshire counts were found.