First National Holdings Data Breach
The 2026 First National Holdings data breach was a security incident reported by the specialty finance company that operates as First National Assets.
This classification is based on a reviewed lower bound; the actual impact and severity may be higher.
Exposed Data Types
2 sensitive7- Medical information
- Health insurance information
- Names
- Social security numbers
- Driver's license numbers
- Financial information
- Credit and debit card numbers
About This Breach
Official records list 34,507 affected Texas residents and 12 affected Massachusetts residents. Because a definitive nationwide total has not been disclosed, the independently verifiable 34,519 people are presented as a lower bound.
First National Assets purchases real-estate tax liens and similar assets from municipalities and services those holdings. The notice was filed under the legal name First National Holdings, LLC, so both names are used together to identify this event.
What Is Known About the Incident?
The company's sample letter dated July 8, 2026 says that a security incident may have affected certain personal information. The public official documents do not disclose when unauthorized access began or ended, the method used, or the responsible party. The event is therefore not labeled as ransomware, phishing, or another specific attack type.
What Information Was Affected?
The Texas record lists names, Social security numbers, driver's license numbers, financial information, and health insurance information. The Massachusetts record also indicates that medical records and credit or debit card information may have been involved for some people. Because the notice uses a recipient-specific data field, every category should not be assumed to have applied to every person.
How Did the Company Respond?
First National Holdings said it restored its systems, tightened access controls, and was evaluating additional technical safeguards. Affected people were offered 24 months of credit monitoring and identity-theft protection through IDX. The complimentary enrollment period in the sample letter ends on October 8, 2026.
What Should Affected People Do?
Recipients of a letter using the First National Holdings or First National Assets name should review the data categories listed for them and their IDX enrollment code. If a Social Security number or financial information was involved, credit reports and account activity can be monitored, and a free credit freeze or fraud alert may be appropriate. Medical and insurance records should also be checked for unfamiliar claims or services.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
