Ericsson data breach: a service provider's vishing incident, and letters ten months later

Date	Event
April 17 to 22, 2025	Information acquired without authorization from the service provider
About April 28, 2025	Provider becomes aware of the vishing incident; forced password reset; FBI notified
About November 10, 2025	Provider tells Ericsson that Ericsson-related data was involved
February 23, 2026	Identities and addresses of the people affected confirmed
March 9, 2026	Letters to about 239 Massachusetts residents; notice to Massachusetts

What happened at Ericsson's service provider?

The notice, filed by counsel for the service provider, says the provider became aware around April 28, 2025 of a vishing incident involving a single individual associated with it. Vishing is voice phishing: a phone call that talks someone into giving up a login or approving access. The provider brought in cybersecurity experts, forced a password reset, notified the Federal Bureau of Investigation and opened an investigation, which found the April 17 to 22 window.

Ericsson's role is as the owner of the data. The notice says Ericsson holds personal data of employees and of others it does business with, and shares it with service providers in the course of its business. The notice does not say which of those groups the 239 Massachusetts residents belong to, or what service the provider performs.

Why did the Ericsson letters take so long?

Two reviews, one after the other. The provider first reviewed what information was involved and whose it was, then told Ericsson around November 10, 2025, about six and a half months after it found the incident. Ericsson and the provider then confirmed identities and addresses, finishing on February 23, 2026, and the letters went out two weeks later. From the end of the access to the letters is 321 days. The notice delay guide compares that with other notices.

What information was exposed?

The notice says it varied by person but may include first and last name, Social Security number, and financial account information with access information. The notice pairs the account information with access information, which goes beyond an account number alone. Massachusetts marks four categories: Social Security numbers, medical records, financial accounts and driver's licenses. That is broader than the notice's own list.

Record	People	Data it marks
Massachusetts OCABR, report 2026-350	239	Social Security numbers, medical records, financial accounts, driver's licenses

What is Ericsson offering?

Twenty-four months of credit monitoring through IDX at no cost. The letters also include guidance on fraud alerts, security freezes and tax fraud. With account access details in the data, the first step is to call the bank, change any PIN or password on the account, and ask whether a new account number is needed. For vendor breaches where the company you know writes about a provider you never saw, see the guide to letters from a company you never dealt with.

What the documents leave open

• The name of the service provider and what it does for Ericsson.
• Whether the people affected are employees, former employees or business contacts.
• The total number notified outside Massachusetts.