HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

TruePoint

bd_ba2f21f703d3869a · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 26, 2026

Filed

Apr 24, 2026

To disclose

29 days

Affected

1state residents only

Confidence

64%

Full breach record for TruePoint →

Truepoint Inc notified clients of a cybersecurity incident on March 26, 2026, where an unauthorized party temporarily accessed company files. Four files were downloaded, containing no actionable information. Other accessed files contained client names, addresses, email addresses, and account numbers. Truepoint engaged forensic experts, contained the access, and is offering to cover passport replacement costs for affected individuals.

J jump to incidentP pin to compareR raw source

Massachusetts clock✓ MA AG ≤30d29 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 29 days

Mar 26, 2026

Begins

Mar 26, 2026

Discovered

Apr 24, 2026

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: TruePoint
norm: truepoint
Domain: truepoint.com

Name: TruePoint
norm: truepoint
Domain: truepoint.com
Industry: Financial Servicesllm

Discovered: Mar 26, 2026
Breach occurred: Mar 26, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Identified and eliminated the unauthorized access shortly after it was established
Launched a thorough investigation with the assistance of trusted third-party forensic experts
Began proactively monitoring client accounts for unusual activity
Worked closely with custodians to review account security and implement precautionary restrictions
Continue to monitor accounts daily
Changes made: Covering the cost of new passports and mailing applications for affected clients
Encouraging the use of multi-factor authentication, strong passwords, and account alerts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: MA AG ≤30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-640-truepoint-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2026
Raw hash: 4555abfcae12eea29caca5905430fb81bf4067adcb4a3ac6b264bb69ccd169db

Reporting entityTruePoint

Victim entityTruePoint

Incidentdiscovered Mar 26, 2026

Stated responseIdentified and eliminated the unauthorized access shortly after it was established

ComplianceMA AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov