ICW Group data breach letter: social engineering of one employee in May 2026 reached claimant data

Date	Event
May 1, 2026	An ICW employee is targeted by social engineering
May 1 to 4, 2026	Window of unauthorized access to stored personal information
May 19, 2026	ICW becomes aware of the event
November 5, 2026	ICW determines whose information was included
November 13, 2026	Notice posted by the California attorney general

What happened in the ICW Group data breach?

The letter describes a social engineering event aimed at a single employee, which let an unknown third party into a limited set of documents on ICW's systems. ICW says it became aware on May 19, 2026, eighteen days after it began, and opened an investigation. It hired a forensic firm and other outside experts, and it notified law enforcement and worked with it. ICW says it has found no evidence that anyone's data has been used fraudulently. The letter does not say what kind of social engineering was used (a phone call, an email or a message) or what the documents were. Social engineering in SEC 8-K filings shows how other companies have described the same route.

Why did I get a breach letter from ICW Group?

You do not need to have bought a policy from ICW to be in its data. ICW describes itself as a holding company for national commercial insurers offering workers' compensation, catastrophe, assumed reinsurance and other commercial and specialty coverage. It says it handles information received from employees and claimants in the normal course of business. If your employer is insured by ICW, or you made a workers' compensation claim, that may be the link. Why you got a breach letter from a company you never dealt with covers this case.

What information was exposed in the ICW Group breach?

The copy filed in California is a sample, and its data field reads only "test data", so the actual fields appear only on each person's letter. Neither the California posting nor any other state record checked on November 14 lists the categories.

Why did the ICW letter take six months?

ICW became aware on May 19 and identified the people involved on November 5, 170 days later. The letter attributes the time to its detailed analysis of the impacted information. The California posting came eight days after that. The notice-delay guide compares the gap with other notices in the log.

What is ICW Group offering people who got the letter?

A 24-month membership for credit monitoring and identity theft protection through Cyberscout, a TransUnion company, at no charge. Enrollment is at mytrueidentity.com with the activation code on the letter, within 90 days of the letter's date. A dedicated call center is at +1 833-516-9867, Monday through Friday, 8 a.m. to 8 p.m. Eastern. Credit monitoring offers in breach letters compares offers across the log.