On July 18, 2025, eCapital Corp., a provider of alternative financing for small and medium-sized businesses, fell victim to a cyberattack resulting in a data breach. The incident exposed personally identifiable information (PII), including names, addresses, dates of birth, Social Security numbers, and driver’s license numbers of an undisclosed number of individuals across multiple U.S. states. The breach was discovered after an internal investigation, and affected individuals began receiving notification letters on September 18, 2025, with regulatory disclosures filed shortly after. In response, eCapital offered 24 months of free Kroll identity monitoring, including credit monitoring, $1M fraud reimbursement, and identity theft restoration services. The exposed data poses significant risks, such as identity theft, financial fraud, and targeted phishing attacks. While the full scope of the breach remains undisclosed, the compromise of highly sensitive PII—particularly SSNs and driver’s license numbers—heightens the potential for long-term harm to victims, including unauthorized account openings, loan fraud, and reputational damage to the company.
Source: https://www.claimdepot.com/data-breach/ecapital-corp-2025
TPRM report: https://www.rankiteo.com/company/ecapitalcorp
"id": "eca1602816092625",
"linkid": "ecapitalcorp",
"type": "Cyber Attack",
"date": "7/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Residents from multiple states '
'(exact number undisclosed)',
'industry': 'Financial Services (Alternative '
'Financing)',
'name': 'eCapital Corp.',
'type': 'Corporation'}],
'customer_advisories': {'actionable_steps': ['Enroll in identity monitoring',
'Monitor financial accounts',
'Watch for phishing attempts',
'Consider credit freezes'],
'notification_method': 'Mail',
'support_offered': '24 months of free Kroll identity '
'monitoring services (including '
'credit monitoring, fraud '
'reimbursement, and restoration '
'services)'},
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': ['names',
'addresses',
'dates of birth',
'Social Security '
'numbers',
"driver's license "
'numbers'],
'sensitivity_of_data': "High (includes SSNs and driver's "
'license numbers)',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII)'},
'date_detected': '2025-07-18',
'date_publicly_disclosed': '2025-09-18',
'description': 'On July 18, 2025, eCapital Corp., a company specializing in '
'alternative financing solutions for small and medium-sized '
'businesses, discovered it was the target of a cyberattack. '
'The data breach compromised personally identifiable '
'information (PII), including names, addresses, dates of '
"birth, Social Security numbers, and driver's license numbers. "
'The total number of impacted individuals has not been '
'released, but includes residents from multiple states. '
'eCapital began notifying affected individuals by mail on '
'Sept. 18, 2025 and reported the incident to the Maine, '
"Massachusetts, Vermont, and New Hampshire Attorney Generals' "
'offices beginning on Sept. 19, 2025.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'exposure of sensitive PII',
'data_compromised': ['names',
'addresses',
'dates of birth',
'Social Security numbers',
"driver's license numbers"],
'identity_theft_risk': "High (PII including SSNs and driver's "
'license numbers exposed)'},
'investigation_status': 'Ongoing (as of public disclosure in September 2025)',
'post_incident_analysis': {'corrective_actions': ['Provided identity '
'monitoring services to '
'affected individuals',
'Regulatory disclosures '
'completed']},
'recommendations': ['Affected individuals should enroll in the provided '
'24-month Kroll identity monitoring service, which '
'includes single-bureau credit monitoring, $1M identity '
'fraud loss reimbursement, fraud consultation, and '
'identity theft restoration.',
'Monitor credit reports and financial accounts closely '
'for signs of fraudulent activity.',
'Place fraud alerts or credit freezes with major credit '
'bureaus (Equifax, Experian, TransUnion) as a '
'precautionary measure.',
'Remain vigilant against phishing attempts (emails, '
'calls) that may exploit the exposed PII.'],
'references': [{'source': 'eCapital Corp. Breach Notification (Public '
'Advisory)'},
{'source': 'eCapital Corp. Website'}],
'regulatory_compliance': {'regulatory_notifications': {'federal_disclosures': True,
'states': ['Maine',
'Massachusetts',
'Vermont',
'New '
'Hampshire']}},
'response': {'communication_strategy': {'individual_notifications': {'date_started': '2025-09-18',
'method': 'Mail'},
'public_advisory': {'recommendations': ['Sign '
'up '
'for '
'free '
'identity '
'monitoring '
'services',
'Monitor '
'credit '
'reports '
'and '
'financial '
'accounts '
'for '
'unusual '
'activity',
'Be '
'alert '
'for '
'phishing '
'attempts '
'using '
'exposed '
'information',
'Consider '
'placing '
'a '
'fraud '
'alert '
'or '
'credit '
'freeze '
'with '
'major '
'credit '
'bureaus']},
'regulatory_notifications': {'date_started': '2025-09-19',
'states_notified': ['Maine',
'Massachusetts',
'Vermont',
'New '
'Hampshire']}},
'incident_response_plan_activated': True,
'remediation_measures': ['Offering 24 months of free Kroll '
'identity monitoring services to '
'affected individuals'],
'third_party_assistance': {'identity_monitoring_provider': 'Kroll'}},
'title': 'eCapital Corp. Data Breach (2025)',
'type': 'Data Breach'}