YouLend US 2026 Data Breach

The primary evidence is YouLend US's consumer notice published through the California Attorney General breach record. On the company's behalf, the letter directly identifies the organization, network-alert date, four-day unauthorized-access period, file acquisition, person-specific data fields, law-enforcement notification, and protective services offered.

Texas Attorney General record BR-0005177 confirms the event timeline and data categories and reports that 2,793 of the 23,105 affected people were Texas residents. Claim Depot provides an additional source trail connecting the California consumer letter and Texas record to the same event.

YouLend received alerts indicating a disruption to its computer network on June 9. The organization immediately began an investigation and engaged outside cybersecurity specialists. Their joint work found that the network was accessed without authorization from June 5 through June 9 and that certain files containing personal information were acquired during that window.

The public letter does not identify the initial entry method, actor, ransom demand, malware, or technique used to maintain access. The statement that files were acquired confirms data copying but does not establish that the material was publicly released.

The official sample letter tells its recipient that a name, date of birth, and Social Security number were involved. Together, those three fields create substantial risk of fraudulent credit applications, tax-identity misuse, abuse of account-verification processes, and targeted phishing. The same combination should not be assumed to have existed in every affected file.

The protection appendix mentions addresses, driver's licenses, and other identity documents as general examples that may be required to request a credit freeze. That guidance does not confirm those fields were acquired in the incident.

The source connecting the California and Texas filings lists financial-account numbers and credit or debit-card numbers among possible fields for some affected people. Those fields are consistent with the company's role in embedded business financing, but they were not present for every person, and the visible variable portion of the official sample letter identifies only name, birth date, and SSN.

The public material does not specifically confirm a card expiration date, CVV, PIN, bank name, account-access password, or transaction history. Recipients should enable activity alerts with their financial institutions and closely review unfamiliar transactions or new accounts.

Texas Attorney General record BR-0005177 reports 23,105 affected people nationwide, including 2,793 Texas residents. The 89 Rhode Island residents in the sample letter's state appendix are another subset of the nationwide total; state figures are not added again.

YouLend twice states that, as of the letter date, it had no evidence that personal information was misused for fraud or identity theft. That is a favorable but time-bound finding and does not eliminate future risk. Because file acquisition was confirmed and durable identifiers such as SSNs were involved, long-term monitoring may still be appropriate.

YouLend took steps to secure systems, reported the incident to federal law enforcement and other authorities, and offered 12 months of complimentary single-bureau credit monitoring, a credit report, credit score, and proactive fraud assistance through Cyberscout. A help line at 1-844-671-5730 was established from 8:00 a.m. to 8:00 p.m. Eastern on weekdays.

Recipients should enroll only with the official code in their letter and review credit reports and financial accounts for unfamiliar inquiries, accounts, or transactions. If an SSN was involved, freezes at all three bureaus, a fraud alert, and an IRS Identity Protection PIN may be appropriate. SSNs or activation codes should not be shared in unexpected messages claiming to represent YouLend.