City of Peabody data breach: files copied from city systems in June and July 2025, letters in February 2026

Date	Event	Record
June 13, 2025	Unauthorized access to city systems begins	City's letter; Indiana report
July 7, 2025	City finds some network systems inaccessible	City's letter
July 8, 2025	Last day of unauthorized access	City's letter
February 5, 2026	Date on the letters	City's letter
February 9, 2026	Reports to Massachusetts (48,492) and Indiana (49,976 in all, 4 in Indiana); copy filed in Vermont	Massachusetts, Indiana, Vermont

What happened in the City of Peabody cyberattack?

The city's letter says that on July 7, 2025, Peabody became aware that certain computer network systems were inaccessible. It secured its systems and opened an investigation with outside computer specialists, both to work out what had happened and to bring the affected systems back. The investigation found that the intruder had been inside since June 13, more than three weeks before the outage, and had copied data.

The city then reviewed the files involved to find whose information was in them, and the letters went out once that review was done. The letter does not name ransomware or a criminal group, does not say whether a ransom was demanded, and does not say which city departments' systems were affected.

What information was exposed in the Peabody data breach?

The letter filed in Vermont is a template: it names "your name" and leaves the rest as a variable field, so each person's letter is the record of what was found about them. Peabody Weekly News reported the city's statement that the types of information vary by person. The state records describe the notice as a whole:

Record	People	Data marked
Massachusetts OCABR, report 2026-193	48,492 residents	Social Security numbers, financial account numbers, driver's license numbers
Indiana Attorney General	49,976 in total, 4 in Indiana	not broken out

Massachusetts does not mark medical records or card numbers for this report.

Is the City of Peabody breach letter real?

Yes, the city has said so. Peabody Weekly News reported that some residents thought the letters were scams and that the city said they were authentic. The filed letter's return address is a P.O. box in West Sacramento, California, and it offers credit monitoring through IDX with an enrollment code. The questions line is 1-844-518-7398, Monday to Friday from 9:00 a.m. to 9:00 p.m. Eastern Time. Written questions go to the City Auditor at 24 Lowell St, Peabody.

Letters also reached people who had moved away. CBS Boston spoke to a recipient who had lived in Peabody in his teens, more than 30 years earlier, and now lives in Lynn.

I did not get a letter. How do I find out if I was affected?

Call the assistance line. Peabody Weekly News reported that anyone who believes they were affected but did not receive a letter can call 844-518-7398, and that the operators can confirm whether a person is affected from a name and address.

What is Peabody offering?

Credit monitoring through IDX at no cost; the filed template leaves the length as a choice between 12 and 24 months, so a person's own letter states which applies. Enrollment is at response.idx.us/Peabody with the code in the letter. The city says it added network security measures and is reviewing its cybersecurity policies and procedures. The credit monitoring guide compares IDX offers with others.

Why did the letters take seven months?

From the July 7 outage to the February 5 letter is 213 days. The letter puts the time down to the review of the copied files, and gives no date for when that review ended. The government breach notices guide compares how long other cities and counties took, and the notice delay guide sets the times against state deadlines. The Massachusetts 2026 ranking places Peabody among the year's largest reports.

What the documents leave open

• Which systems or departments were reached, and what kind of attack made the systems inaccessible.
• Whether anyone claimed the data or demanded a payment.
• The breakdown of the 49,976 people by state beyond Massachusetts and Indiana.