Indico Data Solutions Data Breach: Social Security Numbers Exposed

Indico Data Solutions, a Boston-based AI software company, disclosed a data breach that may have exposed personal information stored in its online repositories. Indico serves as a data processing vendor for companies in various industries, providing data ingestion and workflow organization services.

On May 7, 2026, Indico Data Solutions determined that it had suffered a cybersecurity incident. The incident may have involved unauthorized access to various online repositories containing corporate customer information.

The company implemented its incident response protocols, took steps to secure its environment and worked with external cybersecurity specialists to investigate the scope of the breach. Indico then notified its corporate customers whose data may have been affected and worked with those customers to identify any individuals whose personal information was present in the compromised repositories.

For certain customers, this identification process was completed on June 17, 2026. At those customers' request, Indico is providing notice to affected individuals and to the Nebraska Attorney General on their behalf.

The types of personal information that may have been exposed include names, addresses, dates of birth, Social Security numbers and medical and health information.

The breach was reported to the California Attorney General, Nebraska Attorney General and the Texas Attorney General. The company also posted a notice of the data security incident on its website.

Indico began notifying consumers on July 16, 2026. The total number of individuals affected across the United States was not disclosed, although so far 2,128 residents of Texas were impacted.

Indico Data Solutions' response to the breach

The company is offering affected individuals 12 months of free single-bureau credit monitoring, credit report and credit score services through Cyberscout, a TransUnion company.

To enroll in the services, affected individuals can visit Cyberscout's activation page and enter the unique code included in their notification letter. Enrollment must be completed within 90 days of the date of the letter.

The company has also set up a dedicated phone line for questions about the incident. Representatives are available Monday through Friday, from 8 a.m. to 8 p.m. Eastern time, excluding holidays, by calling 1-800-405-6108. This phone line will be available for 90 days from the date of the notification letter.