Boston Capital Holdings LP

Summary

Boston Capital Holdings LP reported a data breach in which a sophisticated cyber actor exploited cloud services to gain unauthorized access to files containing personal information such as names, Social Security numbers, driver license numbers, passport numbers and financial account details, affecting approximately sixteen thousand individuals. The company later began reviewing a claim of potential unauthorized access and issued notifications to those impacted, while the ransomware group LeakNet claimed responsibility although the claim remains unconfirmed by the firm or regulators.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Boston Capital Holdings LP is a privately held real estate investment and financial services firm headquartered in Boston, Massachusetts, with a focus on multifamily and affordable‑housing investments, real estate financing, and tax‑exempt bond operations across the United States. According to public accounts, a sophisticated cyber actor gained unauthorized access to the company’s files by exploiting cloud services on or about January 16, 2026. The company reportedly began reviewing a claim of potential unauthorized access on February 12, 2026. Affected individuals were notified of the incident by a letter dated May 18, 2026, and the breach was also reported to state regulators.

The notification letter described the incident as involving a sophisticated cyber actor but did not name the attacker or characterize the event as ransomware. Separately, the ransomware group LeakNet has claimed responsibility for the attack, a claim that has not been confirmed by Boston Capital Holdings or any regulator. Based on public accounts and regulatory filings, the personal information potentially exposed varied by individual and may have included names, Social Security numbers, driver’s license numbers, passport numbers, other government‑issued identification numbers, and financial account information without access codes. Approximately 16,000 individuals across multiple states are believed to have been affected.

In response to the breach, Boston Capital Holdings LP sent breach notification letters to affected individuals on May 18, 2026 and filed reports with state regulators detailing the incident. The law firm Edelson Lechtzin LLP has opened an investigation into potential class action claims on behalf of investors, tenants, business partners, and others whose personal information may have been compromised. The firm will evaluate rights and potential claims at no cost to those who request a case evaluation. Certain details of the incident, including its full scope and the attacker’s identity, remain unconfirmed or have not been publicly detailed.

Sources

Sources available to members: 1 source.