Punch & Associates Data Breach Exposes Financial Information

Punch & Associates Investment Management Inc., an SEC-registered, employee-owned investment adviser headquartered in Edina, Minnesota, disclosed a data breach involving unauthorized access to its computer network.

Between April 2, 2026, and April 3, 2026, an unauthorized actor gained access to the Punch & Associates network. During that window, the actor may have accessed or acquired certain files stored on the network without authorization.

The company first identified the suspicious activity on or about April 3, 2026. An investigation that followed determined on July 13, 2026, that personal information of certain individuals had been potentially accessed and acquired. A comprehensive review of the affected data was then conducted to identify the specific individuals whose information was involved.

The types of personal information exposed included first and last names, Social Security numbers and financial account information.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation on Aug. 24, 2026. The firm began mailing notifications to impacted individuals on Aug. 24, 2026.

Punch & Associates' response to the breach

Punch & Associates is offering affected individuals 12 months of complimentary credit monitoring services by Cyberscout, a TransUnion company.

To enroll, affected individuals should visit the Cyberscout activation page and enter the unique code included in their notification letter. Enrollment must be completed within 90 days from the date of the letter.

Individuals who need help or have questions about the incident can call 1-800-405-6108, available Monday through Friday from 8 a.m. to 8 p.m., excluding U.S. holidays.