On July 18, 2025, eCapital Corp., a company specializing in alternative financing solutions for small and medium-sized businesses, discovered it was the target of a cyberattack. An investigation was launched and it was determined that the data breach compromised personally identifiable information (PII).
Exposed information included names, addresses, dates of birth, Social Security numbers and driver's license numbers. The total number of impacted individuals has not been released, but includes residents from multiple states.
eCapital began notifying affected individuals by mail on Sept. 18, 2025. The cybersecurity incident was reported to the Maine, Massachusetts, Vermont and New Hampshire Attorney Generals' offices beginning on Sept. 19, 2025.
In addition to required state and federal disclosures, eCapital is offering impacted individuals 24 months on free Kroll identity monitoring services. These services include single-bureau credit monitoring, $1 million in identity fraud loss reimbursement, fraud consultation and identity theft restoration.
If you receive a notice from eCapital Corp about this breach, you may want to:
For more information about the company, visit the eCapital Corp. website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.