Sweetwater Development & Management Company Discloses Third-Party Data Breach Impacting Personal Information
Sweetwater Development & Management Company, a Georgia-based real estate investment and development firm, recently reported a data breach stemming from a security incident at its third-party vendor, Ultimus Funds Solutions. The breach, disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation on August 14, 2026, exposed sensitive personal information, including Social Security numbers and driver’s license details.
The company first notified affected individuals on July 30, 2026, followed by a more detailed written notice on August 14, 2026. Unlike previous incidents, this breach did not originate within Sweetwater’s own systems but occurred at Ultimus Funds Solutions, which manages certain data on the company’s behalf. The exact timeline of the breach including when it occurred or was discovered has not been publicly disclosed.
In response, Sweetwater is offering 24 months of free credit monitoring and identity protection services through CyberScout (a TransUnion company), including single-bureau credit monitoring, reports, and fraud assistance. Affected individuals must enroll within 90 days of receiving their notification letter.
Separately, on August 14, 2026, the ransomware group CoinbaseCartel claimed on the Tor network to have obtained data from Sweetwater Holdings, a related entity. The company has not clarified whether this incident is connected to the Ultimus Funds Solutions breach. The total number of individuals affected remains undisclosed.
Source: https://www.claimdepot.com/data-breach/sweetwater-2026
Sweetwater Development & Management Company TPRM report: https://www.rankiteo.com/company/sweetwater-companies
Ultimus Funds Solutions TPRM report: https://www.rankiteo.com/company/ultimus-fund-solutions-llc
Sweetwater Holdings TPRM report: https://www.rankiteo.com/company/sweetwater-holdings-company
"id": "ultsweswe1787092668",
"linkid": "ultimus-fund-solutions-llc, sweetwater-companies, sweetwater-holdings-company",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Real Estate',
'location': 'Georgia, USA',
'name': 'Sweetwater Development & Management Company',
'type': 'Real Estate Investment and Development Firm'},
{'name': 'Sweetwater Holdings',
'type': 'Related Entity'}],
'attack_vector': 'Third-Party Vendor Compromise',
'customer_advisories': 'Affected individuals notified on July 30, 2026, and '
'August 14, 2026',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Social Security numbers',
'Driver’s license details']},
'date_publicly_disclosed': '2026-08-14',
'description': 'Sweetwater Development & Management Company, a Georgia-based '
'real estate investment and development firm, reported a data '
'breach stemming from a security incident at its third-party '
'vendor, Ultimus Funds Solutions. The breach exposed sensitive '
'personal information, including Social Security numbers and '
'driver’s license details. The ransomware group CoinbaseCartel '
'also claimed to have obtained data from Sweetwater Holdings, '
'a related entity.',
'impact': {'data_compromised': 'Social Security numbers, driver’s license '
'details',
'identity_theft_risk': 'High'},
'post_incident_analysis': {'root_causes': 'Third-party vendor (Ultimus Funds '
'Solutions) security incident'},
'ransomware': {'data_exfiltration': 'Alleged by CoinbaseCartel'},
'references': [{'source': 'Massachusetts Office of Consumer Affairs and '
'Business Regulation'},
{'source': 'CoinbaseCartel Tor Network Claim'}],
'regulatory_compliance': {'regulatory_notifications': 'Disclosed to '
'Massachusetts Office '
'of Consumer Affairs '
'and Business '
'Regulation'},
'response': {'communication_strategy': 'Notices sent to affected individuals '
'on July 30, 2026, and August 14, 2026',
'remediation_measures': '24 months of free credit monitoring and '
'identity protection services',
'third_party_assistance': 'CyberScout (TransUnion)'},
'threat_actor': 'CoinbaseCartel (alleged)',
'title': 'Sweetwater Development & Management Company Discloses Third-Party '
'Data Breach Impacting Personal Information',
'type': 'Data Breach'}