North Atlantic States Carpenters Benefit Funds data breach: files taken from the Hamden office

Who are the North Atlantic States Carpenters Benefit Funds?

The notice lists five funds under the NASCBF name: the North Atlantic States Carpenters Pension Fund, the Guaranteed Annuity Fund, the Health Benefit Fund, the Annuity Fund and the Vacation Fund. It says the event may affect people who were the funds' employees, participants or beneficiaries. So a letter can go to a fund employee, a participant or a beneficiary. The letter filed in Massachusetts leaves the name of the specific fund as a blank field, so each letter names the fund that holds the reader's records.

What happened at the carpenters' benefit funds?

The funds say they saw suspicious activity in the network of the Hamden office on or about August 18, 2025. They reset passwords, limited the damage and started a forensic investigation with outside specialists. The investigation found that an unauthorized actor accessed or acquired files on the office's systems that same day. A review of the affected files to find everyone involved was completed on January 13, 2026.

The notice puts one point first: no funds were taken, and participants' benefits and balances with the NASCBF are intact. The funds notified law enforcement and said they would notify state and federal regulators as required. The notice does not say how the actor got in, whether ransomware was involved, or who was behind it.

Date	What happened	Source
August 18, 2025	Suspicious activity seen in the Hamden office network; files accessed or acquired	Website notice; Indiana record
January 13, 2026	Review of the affected files completed	Website notice
February 11, 2026	Notice sent, per Indiana; reported to Massachusetts	Indiana and Massachusetts records
February 13, 2026	Texas publishes the report	Texas record

Notice went out 177 days after the activity, and 29 days after the review ended. The guide to how long companies take to notify compares that gap with other notices in this log.

What information was in the carpenters' funds breach?

It varied by person. The notice says the files could hold some combination of name, date of birth, Social Security number, electronic or digital signature, financial account information, taxpayer identification number, driver's licence or state ID number, medical information and health insurance information.

The state records mark the categories they track. Massachusetts marks Social Security numbers, financial accounts, driver's licences and card numbers as breached, and medical records as not. Texas lists name, address, Social Security number, government ID, financial information, medical information and health insurance information.

Data type	Funds' notice	Massachusetts record	Texas record
Social Security number	Yes	Yes	Yes
Financial account	Yes	Yes	Yes
Driver's licence or state ID	Yes	Yes	Government ID
Medical information	Yes	No	Yes
Health insurance information	Yes	Not tracked	Yes
Electronic signature, taxpayer ID	Yes	Not tracked	Not listed

Each state counts only its own residents' files, so the Massachusetts and Texas columns can differ from each other and from the full list in the notice.

How many people were affected by the carpenters' funds breach?

Indiana gives the only total: 110,435 people. Of the state counts on record, Massachusetts's is by far the largest.

Record	People counted
Indiana attorney general, total	110,435
Massachusetts residents	28,349
Texas residents	567
Indiana residents	149

Texas published its report on February 13, 2026. The ranking of 2026 breaches by people affected shows where the Indiana total falls, and the ranking of breaches affecting Massachusetts residents compares the Massachusetts count.

What are the carpenters' funds offering?

Twenty-four months of credit monitoring through Epiq, at no cost, which each person must activate. The product named in the Massachusetts letter is Epiq Privacy Solutions ID 1B Credit Monitoring-Plus, activated at privacysolutionsid.com with the code in the letter. Its enrolment deadline is a blank field in the filed copy, so the date is the one printed on each letter.

Item	Detail from the letter
Provider	Epiq Privacy Solutions ID
Length	24 months
Monitoring	One credit bureau, with alerts
Where	privacysolutionsid.com, with the activation code
Deadline	Printed on each letter

The guide to credit-monitoring offers compares this offer with others in this log.

Was my information in the North Atlantic States Carpenters breach?

If you received a letter from the North Atlantic States Carpenters Benefit Funds about a data event, sent from a secure processing center in Smithtown, New York, your information was in the files. The funds' question line is 855-720-3044, Monday to Friday, 9 a.m. to 9 p.m. Eastern Time, excluding U.S. holidays, with Spanish and Portuguese services. The notice advises watching account statements and free credit reports over the next 12 to 24 months. The funds also say participants' benefits and account balances are intact.

What the notice leaves open

• How the unauthorized actor got into the Hamden office's network.
• Which of the five funds' records each person's file came from.
• Why the review of the files took until January 2026.
• Whether the Health Benefit Fund also reported the event to federal health regulators.