CAZ Investments data breach: files taken during a five-day intrusion in August 2026

Date	Event
August 8 to 12, 2026	Unauthorized third party in some CAZ systems
August 25, 2026	CAZ determines some of the files held personal information
September 23, 2026	Letters by mail
September 28, 2026	Report to Massachusetts (413 residents)
September 30, 2026	Notice to New Hampshire (120 residents)

What happened at CAZ Investments?

The notice says CAZ experienced an intrusion on certain systems by an unauthorized third party from August 8 through August 12, 2026. CAZ secured its systems, hired outside experts, notified law enforcement and added security measures. It does not say how the intruder got in, which systems were involved, or whether there was a ransom demand.

The two documents phrase the theft differently. The notice to the state says the files were accessible to and exfiltrated by the third party. The letter to individuals says only that the files were accessible, and that CAZ does not know whether the third party viewed the reader's information. The state notice is the more specific of the two.

How fast did CAZ send letters?

In about six weeks. The intrusion ended on August 12, CAZ identified personal information on August 25, and letters were mailed on September 23. That is 42 days from the end of the access to the letters. The notice letter delay guide shows the range.

What information was exposed?

The template letter lists name, address, date of birth, Social Security number, government ID such as a passport, tax identification or driver's license number, and financial account information. Massachusetts marks Social Security numbers, financial accounts and driver's licenses.

Record	People	Data it marks
Massachusetts OCABR, report 2026-1650 (September 28, 2026)	413	SSNs, financial accounts, driver's licenses
New Hampshire DOJ notice (September 30, 2026)	120	Name, address, date of birth, SSN, government ID, financial account information

The letter does not say whether the people notified are investors, employees or others. The guide to why a CPA or advisory firm sent you a breach letter covers similar firms.

What is CAZ offering?

Twenty-four months of identity protection through IDX. CAZ says it has no evidence of misuse or fraud tied to the incident. The letter also points readers to steps such as watching financial statements and credit reports. The credit monitoring guide compares offers.

What the documents leave open

• How the intruder got in and who it was.
• The total number of people notified across all states.
• Whether the taken files have been published.