DisclosureLens
AccidentalProfessional ServicesProfessional ServicesProgramming ErrorCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumResolved

ConnectPay

bd_3bc995535aaa5010 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 5, 2026

Filed

Feb 26, 2026

To disclose

21 days

Affected

Not disclosed

Confidence

66%
Full breach record for ConnectPay

ConnectPay LLC experienced an internal code error between February 2 and February 6, 2026, that incorrectly exposed 1099NEC data (including names, SSNs, and addresses) of employees to other employees of the same company. No malicious actors were involved. The issue was discovered on February 5, 2026, and access was removed on February 6. A permanent code fix was deployed on February 11, 2026. Affected Massachusetts residents are offered 18 months of credit monitoring.

Massachusetts clock MA AG ≤30d21 days discovery → filing

Incident timeline

undetected · 3 days
discovery → filing · 20 days

Feb 2, 2026

Begins

Feb 5, 2026

Discovered

Feb 26, 2026

Filed

vs. sector median

16 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.