Hennessy Advisors data breach: Hennessy Funds investor data released nine months after the intrusion

Date	Event
March 30, 2025	Hennessy Advisors discovers suspicious activity affecting its access to some systems and data
December 3, 2025	Form 10-K: no material cybersecurity incident
Late December 2025	Hennessy learns data was accessed and released without authorization
February 5, 2026	Review of the released data finds personal information
February 23, 2026	Letters, including 95 to New Hampshire
February 24, 2026	Reports to New Hampshire and Massachusetts (346 residents)

What happened at Hennessy Advisors?

The notice describes an incident that first showed as a loss of access. On March 30, 2025, Hennessy found suspicious activity that affected its access to certain systems and data, and began investigating. It hired outside specialists to find out what happened and secure its systems, and kept monitoring. The notice does not use the word ransomware, does not name an attacker and does not say how the intruder got in.

The turning point came nine months later. The letter says Hennessy learned in late December 2025 that data, including personal information of some investors in the Hennessy Funds, had been accessed and released without authorization. The letters do not say where the data was released. Hennessy found the readers' information by reviewing that released data. For other cases where the data surfaced before the letters, see the double extortion guide.

Did Hennessy Advisors disclose the incident to the SEC?

Not as a material incident. Hennessy is listed on Nasdaq and files with the SEC. Its annual report for the year ended September 30, 2025, filed on December 3, says it had not experienced a material cybersecurity incident. Its 2026 8-Ks cover results, a shareholder vote, investor materials and a note redemption, not the incident. The Item 8.01 versus Item 1.05 guide explains how companies make that call.

Who got a letter from Hennessy Advisors?

People whose information Hennessy held through business dealings with it, including investors in the Hennessy Funds. The letter says the incident may have affected personal information shared as part of the reader's business dealings with Hennessy. A fund shareholder may know the fund's name better than the adviser's. The guide to letters from a company you never dealt with explains that pattern.

What information was exposed?

It differs by person. For New Hampshire residents the notice lists name, Social Security number, driver's license and financial account information. Massachusetts marks the same three categories.

Record	People	Data it marks
Massachusetts OCABR, report 2026-271 (February 24, 2026)	346	SSNs, financial accounts, driver's licenses
New Hampshire DOJ notice (February 24, 2026)	95	Name, SSN, driver's license, financial account information

What is Hennessy offering?

Identity protection through IDX: 12 months of credit monitoring, dark web monitoring, a $1 million identity fraud loss reimbursement policy and identity theft recovery services. IDX runs a toll-free call center for questions. The credit monitoring guide compares the offers.

What the documents leave open

• How the intruder got in, and whether a ransom was demanded.
• Where the data was released.
• The total number of people notified across all states.