2026 Castle Group / Castle Management — network access Sep 2025–Feb 2026; Qilin claim; SSNs/financials
Data compromised
Names; Social Security numbers; financial accounts; driver’s licenses / government IDs; credit/debit card numbers; health records (per Mass./Vermont regulator summaries and sample notice)
Technical writeup
Verified company notification via Massachusetts OCABR / Vermont AG sample notices summarized in trade and consumer filings — August 26, 2026 reporting window. Castle Management, LLC (Castle Group property management) stated an unauthorized actor may have accessed its network from September 2025 to about February 2026; forensic work completed August 11, 2026 confirmed personal information on impacted systems. Qilin posted a claim against the organization around February 17, 2026. State summaries list SSNs, financial accounts, DLs/government IDs, payment cards, and in Vermont filings also health records. National individual count not published at catalog time (state resident subsets only); recordsAffected 0; companyConfirmed true.
Root cause
Unauthorized network access September 2025–February 2026; Qilin publicly claimed Castle data on or about February 17, 2026; company completed forensic review August 11, 2026