Tower Administrative Services data breach: 248,940 people after a February 2026 network intrusion

How many people were affected by the Tower Administrative Services data breach?

248,940 in total, the number Tower reported to Indiana. The letter gives no count. The state lists count their own residents:

Regulator	Who it counts	Number	Recorded
Indiana attorney general	Total reported by Tower	248,940	Notice sent June 23, 2026
Texas attorney general	Texans	25,742	Posted June 26, 2026
Indiana attorney general	Indiana residents	2,540	Notice sent June 23, 2026
Washington attorney general	Washington residents	868	Reported June 26, 2026
California attorney general	No count published	—	Recorded June 25, 2026

Texas's attorney general lists 25,742 Texans for Tower Administrative Services, posted on June 26, 2026, and records Social Security numbers and financial information as involved.

The ranking of 2026's largest breaches explains how Indiana's list counts totals, and why one notice can appear on several state lists with different numbers.

What happened, and when?

Date	Event
On or around February 3, 2026	Unauthorized access to or acquisition of information
February 4, 2026	Tower identifies suspicious activity and starts an investigation with outside specialists
On or around May 20, 2026	Review of the affected data, the people it relates to and their addresses is completed
June 23, 2026	Notice sent, per Indiana
June 25, 2026	Notice recorded by California
June 26, 2026	Notice reported to Washington

Discovery to the Indiana notice took 139 days, 34 of them after the review ended. The guide to notice delays compares this with the rest of the log.

Why would I get a letter from Tower Administrative Services?

The letter does not describe Tower's business or say how it came to hold the reader's information. It tells readers to check their account statements and their explanation of benefits forms. Texas's attorney general lists Tower's entity type as insurance services. People who never dealt with Tower directly can still receive its letter when it holds data for another organization; the guide to letters from companies you never dealt with explains how that happens.

What information was involved?

Each letter pairs the reader's first and last name with its own list of data elements, and the filed copy leaves that list blank. For its 868 residents, Washington's attorney general lists names, Social Security numbers and financial and banking information. The letter says there is no evidence that any of the information has been, or will be, misused.

What is Tower offering?

Item	Detail from the letter
Service	Credit monitoring with alerts from the credit bureau, plus proactive fraud assistance, from Cyberscout through Identity Force, a TransUnion company
Length	Printed on each letter; blank in the filed copy
Enrollment	Within 90 days of the letter date, online with the code on the letter; an email account is needed, and minors under 18 may not be able to enroll
Questions	A dedicated line printed on each letter, 8 a.m. to 8 p.m. Eastern, Monday to Friday; or by mail to 8 Marticville Road, Lancaster, PA 17603

For letters dated in June 2026, the 90-day window has closed. The guide to credit monitoring offers compares offers like this one.

What Massachusetts recorded

Massachusetts' Office of Consumer Affairs and Business Regulation lists a report from Tower Administrative Services, Inc, received on June 26, 2026, with 2,124 Massachusetts residents affected. For those residents it marks Social Security numbers and financial account numbers as breached.

What the documents leave open

• Whose data Tower held, and in what role.
• Which data elements were involved, and for how many people.
• How the intruder got in, and whether data was taken or only reached.