ECBM Data Breach

ECBM identified suspicious system activity on October 25, 2024, and began an investigation with cybersecurity specialists. The investigation found that an unknown person accessed or acquired certain information in the affected systems without authorization between October 19 and October 25, 2024. The technical method of initial access was not disclosed. Notifications were sent on June 3, 2026.

The information varied by person. State notices and notification summaries identify names, Social Security numbers, driver's license numbers, and other government-issued identification numbers. They do not indicate that every information type applied to every affected person.

The company investigated with cybersecurity specialists, assessed the security of its systems, and notified federal law enforcement. ECBM said it implemented additional safeguards and employee training and offered affected people complimentary credit monitoring and fraud assistance. At the time of the notice, the company said it was not aware of misuse of the information.

Notice recipients should check their letters for the enrollment terms of the complimentary monitoring service and review credit reports and financial accounts for unfamiliar activity. People whose Social Security numbers or identity-document information were involved may consider a fraud alert or credit freeze based on their circumstances and should contact the relevant authority if they find signs that an identity document has been misused.