The breach, which reportedly occurred around January 16, 2026, remained under internal review for nearly a month before the company began assessing unauthorized access claims in February. Although Boston Capital Holdings issued formal notifications on May 18, 2026, significant questions persist regarding the full scope of the exposure. While the ransomware group LeakNet has publicly claimed responsibility for the intrusion, Boston Capital and regulatory bodies have yet to verify that assertion or disclose the specific nature of the stolen data.

Potentially compromised information includes Social Security numbers, passport details, driver’s licenses, and financial account data. For the investors, tenants, and business partners involved, this exposure creates a long-term risk of tax fraud and unauthorized account activity. Edelson Lechtzin LLP is currently evaluating potential class action claims to recover damages for affected parties, emphasizing that the firm provides confidential case evaluations for those seeking legal recourse or guidance on securing their credit reports.