Indico Data Solutions breach: was my Social Security number exposed?

On May 7, 2026, Indico Data Solutions, a Boston company that makes AI software for insurers, determined it had a cybersecurity incident. Someone may have gotten unauthorized access to online file stores that held its corporate customers' information.

Indico told those business customers and then, at their request, started writing to people whose personal information was in the files. Letters began July 16, 2026. Names, addresses, and Social Security numbers may have been involved. The company offered 12 months of free credit monitoring through Cyberscout (a TransUnion company) and says it has no evidence of misuse. It posted a public notice and reported four Nebraska residents to that state's attorney general. A proposed class-action lawsuit was filed around August 14, 2026.

This was not a company you chose

Most coverage treats this as a breach at “a Boston AI company.” That is accurate, and it is also the least useful way to understand it if you are trying to decide whether it touches you.

Indico is not a bank, an insurer, or a site you log into. It is a vendor that insurance companies use behind the scenes. If your information is in this incident, it is because an insurer you dealt with sent it to a firm you were never asked to approve. For a lot of people, the first time they will see the word Indico is on a letter, in a news alert, or in an ad from a law firm.

The sentence that gets repeated is that there is no evidence of misuse. That is what the company has said, and nothing public contradicts it. It is not the same as “this is over.” A Social Security number sitting next to a real name and a home address stays useful to a stranger for years. The 12 months of monitoring Indico is offering is a standard corporate response. It is not an estimate of how long that combination remains valuable.

We also do not have a confirmed nationwide headcount. The only official number in a regulator filing that can be checked is four people in Nebraska. Headlines that say “thousands” are repeating a lawsuit, not the company’s own notice. There is no public list of names, and no website that can reliably tell you whether you were in this specific incident.

What to actually expect

• If you were notified, it should arrive as a letter. Indico said mailing started July 16, 2026. That letter is the confirmation that counts, and it should include a way to enroll in the 12 months of Cyberscout coverage.
• You may hear this from an insurer, not from a brand you recognize. Because Indico sits behind insurance companies, the paper trail can look confusing.
• Law-firm ads about a class action will show up. A lawsuit was filed around August 14, 2026. Those ads are not official notice that you were included, and they cannot tell you whether your data was in the files.
• In the near term, the realistic risk from this mix of data is someone opening credit, filing a tax return, or using your Social Security number for work or benefits in your name. This incident did not, on the What's Publicly Reported, expose bank logins or payment cards.

What you can and cannot fix

If your name, home address, and Social Security number were in those files, that combination cannot be taken back. A Social Security number is not a password. You generally cannot cancel it or replace it because it leaked. Anyone who has it, has it.

What actually helps, in order:

• Use the free monitoring if a letter arrived. Enroll in the 12 months of Cyberscout that Indico offered. It will not stop someone from using your Social Security number, but it is the one service tied to this incident and it costs you nothing.
• Freeze your credit. A freeze at Equifax, Experian, and TransUnion is the step that actually blocks most new-account fraud. Monitoring tells you after the fact. A freeze is free, and you can lift it when you need credit.
• Get an IRS Identity Protection PIN. Name, address, and Social Security number are exactly what someone needs to file a tax return in your name. An IP PIN stops that specific move. You set it up on the IRS website.
• Shrink the rest of your public footprint. A leaked record of your name, address, and Social Security number becomes much more dangerous when it can be joined to people-search listings that add relatives, phone numbers, employers, and previous addresses. Those listings, unlike the data from this incident, can actually be removed. That is the lever you still have.