Capital Economics Data Breach

• Identity and contact data: Names, email addresses, phone numbers, and physical addresses.
• Professional profile data: Employer names and job titles.

Contact details combined with professional profile data can support spear-phishing, executive or colleague impersonation, fraudulent invoice requests, and business-email-compromise attempts. Address and phone data may also be combined with other sources to build a more detailed identity profile. Passwords, bank-account details, and payment-card data are not listed in the recorded scope and should not be assumed to have been exposed.

1. Verify unusual payment, document, or credential requests claiming to come from Capital Economics, an employer, or a senior colleague through a second channel.
2. Protect email accounts with unique passwords and two-factor authentication, and review active sessions and unexpected forwarding rules.
3. When someone requests personal information by phone or email, call back through an official contact channel rather than using details in the message.
4. Monitor unexpected mail, account-opening notices, or financial notifications and report suspicious activity to the relevant provider.

Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.