NBOA Data Breach Affects 3,580 individuals, Exposing SSNs

The National Boat Owners Association (NBOA), a marine insurance agency, experienced a data breach that affected 3,580 individuals across the United States, including 154 residents of Massachusetts and 15 residents of Maine.

The breach occurred between mid-May 2025 and early June 2025, when cybercriminals gained unauthorized access to NBOA’s network through a compromise of one of the company’s managed service providers. The incident was discovered on June 6, 2025.

According to forensic investigators, the INC Ransomware group was responsible for the attack. Shortly after the breach, the group claimed on the dark web (via the Tor network) that they had obtained data from NBOA, with the posting dated July 22, 2025.

The information exposed in this breach included personally identifiable information (PII) such as full names, addresses, driver's licenses, Social Security numbers, insurance information, and insurance policy numbers.

The company notified affected consumers on Jan. 21, 2026. NBOA disclosed the breach to several state authorities, including the Maine Attorney General, the Massachusetts Office of Consumer Affairs and Business Regulation, and the Vermont Attorney General on Jan. 21, 2026, and Jan. 22, 2026.

National Boat Owners Association's response

After discovering the breach, the company terminated the services of the compromised managed service provider and engaged a nationally recognized forensic firm to conduct a comprehensive investigation. In addition, NBOA reviewed and enhanced its cybersecurity policies and implemented additional safeguards to further secure its systems.

To support those affected, the company is offering complimentary access to Experian IdentityWorks for 24 months. This service includes identity monitoring, credit monitoring, identity restoration support, and up to $1 million in identity theft insurance.

Affected individuals are encouraged to enroll in this program and remain vigilant by regularly reviewing credit reports and account statements for signs of fraud or identity theft.

It is also recommended to promptly report any suspicious activity to the appropriate authorities and take advantage of the resources provided by NBOA and Experian.