On June 2, 2026, the hacking collective known as CoinbaseCartel asserted it had breached CMT’s systems, threatening to expose internal records unless the company initiated ransom negotiations. Intelligence monitors, including Ransomware.live, flagged the claim, yet the Massachusetts-based insurtech firm has failed to confirm the incident or issue mandatory notifications to those potentially affected. This lack of transparency may place the company in direct violation of federal and state data protection statutes.

Evidence suggests the compromised dataset includes granular driving behavior, such as acceleration, braking patterns, and mobile phone distraction events. Beyond telematics, the breach reportedly exposed GPS coordinates, specific travel routes, and comprehensive personally identifiable information, including user profiles and insurance account details. Schubert Jonckheer & Kolbe is currently evaluating claims for damages and potential court-ordered mandates to overhaul the firm's cybersecurity protocols, urging affected individuals to evaluate their legal standing regarding identity theft risks.