Punch & Associates Investment Management Reports Data Breach Affecting Personal and Financial Information
Punch & Associates Investment Management Inc., an SEC-registered, employee-owned investment adviser based in Edina, Minnesota, disclosed a data breach involving unauthorized access to its network. Between April 2 and April 3, 2026, an unauthorized actor infiltrated the firm’s systems, potentially accessing or exfiltrating sensitive files.
The company detected suspicious activity on April 3, 2026, and launched an investigation, which concluded on July 13, 2026, that personal information had been compromised. A subsequent review identified the affected individuals, whose data may have included names, Social Security numbers, and financial account details.
The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation on August 24, 2026, the same day Punch & Associates began notifying impacted individuals. As part of its response, the firm is offering 12 months of complimentary credit monitoring through Cyberscout, a TransUnion company, with enrollment available via a unique code provided in notification letters. Support for affected individuals is accessible via a dedicated hotline.
Source: https://www.claimdepot.com/data-breach/punch-associates-2026
Punch & Associates Investment Management, Inc. cybersecurity rating report: https://www.rankiteo.com/company/punch-&-associates-investment-management-inc-
"id": "PUN1787927639",
"linkid": "punch-&-associates-investment-management-inc-",
"type": "Breach",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Identified individuals (exact '
'number not specified)',
'industry': 'Financial Services',
'location': 'Edina, Minnesota, USA',
'name': 'Punch & Associates Investment Management Inc.',
'type': 'Investment Adviser'}],
'customer_advisories': '12 months of complimentary credit monitoring offered '
'via Cyberscout',
'data_breach': {'data_exfiltration': 'Potential',
'personally_identifiable_information': ['Names',
'Social Security '
'Numbers',
'Financial Account '
'Details'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Information',
'Financial Information']},
'date_detected': '2026-04-03',
'date_publicly_disclosed': '2026-08-24',
'description': 'Punch & Associates Investment Management Inc. disclosed a '
'data breach involving unauthorized access to its network. '
'Between April 2 and April 3, 2026, an unauthorized actor '
'infiltrated the firm’s systems, potentially accessing or '
'exfiltrating sensitive files containing personal and '
'financial information.',
'impact': {'data_compromised': 'Personal and financial information, including '
'names, Social Security numbers, and financial '
'account details',
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'investigation_status': 'Concluded (July 13, 2026)',
'references': [{'source': 'Punch & Associates Investment Management Data '
'Breach Notification'}],
'regulatory_compliance': {'regulatory_notifications': ['Massachusetts Office '
'of Consumer Affairs '
'and Business '
'Regulation']},
'response': {'communication_strategy': 'Notification letters to affected '
'individuals, dedicated hotline for '
'support',
'incident_response_plan_activated': 'Yes',
'third_party_assistance': 'Cyberscout (TransUnion) for credit '
'monitoring'},
'title': 'Punch & Associates Investment Management Data Breach',
'type': 'Data Breach'}