Charlottesville Settlement Company Data Breach Exposes Personal Information of Over 22,000 Individuals
Charlottesville Settlement Company (CSC), a Virginia-based title and settlement agency, is under investigation following a data breach that may have exposed sensitive personal information. The incident, detected on September 4, 2025, revealed that an unauthorized actor accessed CSC’s network on September 2, 2025, potentially acquiring consumer files.
After securing its systems and conducting a forensic investigation with external cybersecurity experts, CSC determined on March 10, 2026, that personal data may have been compromised. The company began notifying affected individuals in writing on March 18, 2026. According to filings with the Maine Attorney General’s office, 22,041 people across the U.S. were impacted, including 19 residents of Maine.
At this time, names are the only confirmed type of exposed information. CSC, founded in 2007, provides real estate closing, title insurance, and settlement services in the Charlottesville area through affiliated entities, including Shenandoah Settlement Services LLC (now High Crest Settlement) and Freedom Settlement Services LLC.
Class action law firm Shamis & Gentile P.A. is investigating potential legal claims on behalf of affected individuals. The firm notes that those impacted may be entitled to compensation for any resulting harm.
Source: https://www.claimdepot.com/investigations/charlottesville-settlement-company-data-breach-2026
VSTITLE cybersecurity rating report: https://www.rankiteo.com/company/valley-southern-title-ltd-
CloSure Title & Settlement Company LLC cybersecurity rating report: https://www.rankiteo.com/company/closure-title-&-settlement-company-llc
"id": "VALCLO1773938598",
"linkid": "valley-southern-title-ltd-, closure-title-&-settlement-company-llc",
"type": "Breach",
"date": "9/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '22041',
'industry': 'Real estate, Title insurance, Settlement '
'services',
'location': 'Charlottesville, Virginia, USA',
'name': 'Charlottesville Settlement Company (CSC)',
'type': 'Title and settlement agency'}],
'customer_advisories': 'Written notifications sent to affected individuals',
'data_breach': {'number_of_records_exposed': '22041',
'personally_identifiable_information': 'Names',
'sensitivity_of_data': 'Confirmed: Names; Other data types '
'not specified',
'type_of_data_compromised': 'Personal information'},
'date_detected': '2025-09-04',
'date_publicly_disclosed': '2026-03-18',
'description': 'Charlottesville Settlement Company (CSC), a Virginia-based '
'title and settlement agency, is under investigation following '
'a data breach that may have exposed sensitive personal '
'information. An unauthorized actor accessed CSC’s network on '
'September 2, 2025, potentially acquiring consumer files. The '
'breach was detected on September 4, 2025, and after a '
'forensic investigation, CSC determined on March 10, 2026, '
'that personal data may have been compromised. Notifications '
'were sent to affected individuals starting March 18, 2026.',
'impact': {'data_compromised': 'Personal information',
'legal_liabilities': 'Potential legal claims',
'systems_affected': 'CSC’s network'},
'investigation_status': 'Ongoing',
'references': [{'source': 'Maine Attorney General’s office'},
{'source': 'Shamis & Gentile P.A.'}],
'regulatory_compliance': {'legal_actions': 'Class action investigation by '
'Shamis & Gentile P.A.',
'regulatory_notifications': 'Filed with Maine '
'Attorney General’s '
'office'},
'response': {'communication_strategy': 'Written notifications to affected '
'individuals',
'containment_measures': 'Systems secured',
'third_party_assistance': 'External cybersecurity experts'},
'threat_actor': 'Unauthorized actor',
'title': 'Charlottesville Settlement Company Data Breach Exposes Personal '
'Information of Over 22,000 Individuals',
'type': 'Data Breach'}