CodeSecure Data Breach Compromised PHI and PII of Individuals

CodeSecure Inc., a software security company headquartered in Bethesda, Md., disclosed a data breach that occurred in September 2025.

CodeSecure, formerly the product division of GrammaTech, is a global provider of application security testing solutions, including static application security testing and software composition analysis products. Because CodeSecure has since been integrated into AdaCore, the company stated in its notice that the September 2025 incident may affect only CodeSecure systems before their technical integration with AdaCore.

The breach was reported to the Vermont Attorney General on Oct. 28, 2026. CodeSecure posted a notice about the incident on its website on Oct. 27, 2026.

CodeSecure detected suspicious activity within its computer network. An investigation into the incident determined that an unauthorized actor gained access to the company's systems on Sept. 15, 2025.

The company's notification did not specify when the suspicious activity was first detected or how long the unauthorized actor may have had access to the systems.

A comprehensive review was conducted as part of the investigation to determine what information may have been affected by the unauthorized access. The review identified multiple categories of sensitive data that were potentially exposed, spanning both personally identifiable information and protected health information.

The personally identifiable information that may have been exposed included names, addresses, dates of birth, Social Security numbers, driver's license numbers, passport information, financial account information, usernames and passwords, and codes used to access accounts.

The protected health information that may have been exposed included medical and health insurance records.

CodeSecure's response to the breach

CodeSecure is mailing notification letters to individuals whose information may have been potentially exposed by the breach. These letters may include an offer of complimentary credit monitoring services to affected individuals.

The company also encouraged those who may be affected to remain vigilant against incidents of identity theft by reviewing account statements for unusual activity and reporting any suspicious transactions to their financial institutions.