JM Forbes data breach: a business email compromise attempt stopped before any payment moved

Date	Event
November 17, 2025	JM Forbes detects suspicious activity on its email system and locks down the account
March 25, 2026	The investigation confirms one email account with personal information was accessed
April 7, 2026	First round of letters; notices to New Hampshire (19 residents) and Massachusetts (420)

What happened at JM Forbes?

A business email compromise attempt: the outsider wanted to use the mailbox to divert payments. The notice describes the firm as a wealth management firm that provides financial management services to clients. On November 17, 2025, it detected suspicious activity on its email system, locked down the affected account, and opened an investigation with outside counsel and forensic experts.

The scheme failed on the money side. The letter says the firm's compliance monitoring and internal controls quickly flagged the unusual activity, and the team stopped the attempt before any fraudulent transaction happened. The data side is what the letters are about: the mailbox held client information the outsider could reach.

For other attacks that began with a call or a lure to staff, see the social engineering in 8-K filings guide. For why an investment firm writes these letters, see the guide to why a CPA or advisory firm sent you a breach letter.

Will more people get letters?

Possibly. JM Forbes calls the April letters an initial tranche. It says the investigation is still running and that it will send more notices if it finds more people affected. No supplemental notice was found in the New Hampshire records checked for this entry. The Massachusetts count of 420 is from the April report.

What information was exposed?

Name, address, Social Security number and account numbers. The firm stresses that the account numbers were exposed without the security code needed to access the accounts. Massachusetts marks Social Security numbers, financial accounts and driver's licenses.

Record	People	Data it marks
Massachusetts OCABR, report 2026-536 (April 7, 2026)	420	SSNs, financial accounts, driver's licenses
New Hampshire DOJ notice (April 7, 2026)	19	Name, address, SSN, account numbers

What is JM Forbes offering?

Two years of credit monitoring at no cost, for everyone notified. The firm says it has strengthened its safeguards and added staff training. The credit monitoring guide compares offers.

What the documents leave open

• How the employee was socially engineered, by phone, email or another channel.
• Whether a second round of letters was sent, and the final total.
• How long the outsider had access to the mailbox.