Five States Energy Co. Data Breach Exposes Social Security Numbers

Five States Energy Co., a private equity investment firm investing in the energy sector and based in Dallas, Texas, disclosed a data breach that may have exposed sensitive personal and financial information.

The breach was reported to the New Hampshire Attorney General on April 2, 2026, with 10 New Hampshire residents identified as affected.

According to the company's notification to consumers, approximately four Rhode Island residents may also be impacted. Five States discovered the breach on Feb. 12, 2026, and began notifying affected individuals on March 26, 2026.

Five States detected and stopped a compromise of its network environment on Feb. 12, 2026. The company immediately secured and remediated the compromise. It then engaged third-party experts to conduct a digital forensic investigation into the full extent of the unauthorized activity.

The investigation determined that certain investment files containing personal and financial information were subject to unauthorized access, including full names, dates of birth, contact information, Social Security numbers and bank account numbers.

Five States Energy's response

Given the sensitive nature of the information involved, Five States is offering 24 months of free credit monitoring and identity protection services through CyberScout, a TransUnion company. These services provide alerts when changes occur to a credit file and include proactive fraud assistance.

To enroll, affected individuals can visit CyberScout's activation page and enter the unique code included in their notification letter. Enrollment must be completed within 90 days of the letter's date. The enrollment requires an internet connection and email account and may not be available to minors under 18.

According to the notification, the company has no evidence of fraud or misuse of personal information arising from the incident at this time. Five States also noted it is continuously enhancing the security of its systems and focusing on awareness training and data security assessments.

Individuals with questions can call 833-877-5095 between 8:00 a.m. and 8:00 p.m. EST, Monday through Friday, excluding U.S. holidays.