**Canary Benefits Data Breach Exposes Sensitive Consumer Information**
In December 2025, Canary Benefits, Inc., a New York City-based fintech company specializing in emergency relief fund programs, reported a cybersecurity incident that may have compromised sensitive consumer data. The breach was disclosed to the Massachusetts Attorney General’s office on December 17, 2025, with affected individuals notified by mail.
Canary Benefits operates Grant Circle, a white-labeled platform that helps employers and nonprofits administer emergency cash grants to individuals in financial distress. The company serves clients ranging from small businesses to large corporations and community foundations.
The exposed data may include:
- First and last names
- Social Security numbers
As part of its response, Canary Benefits is offering affected individuals 24 months of free credit monitoring and identity theft protection through Cyberscout (a TransUnion company), with enrollment required within 90 days of notification. The law firm Shamis & Gentile P.A. is investigating the breach and potential legal claims for compensation on behalf of impacted individuals.
The incident highlights risks associated with the handling of personally identifiable information (PII) in financial services, particularly for organizations managing sensitive relief programs.
Source: https://www.claimdepot.com/investigations/canary-benefits-data-breach-2025
Canary 🐤 cybersecurity rating report: https://www.rankiteo.com/company/workwithcanary
"id": "WOR1766008673",
"linkid": "workwithcanary",
"type": "Breach",
"date": "12/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Financial Services / Emergency Relief '
'Funds',
'location': 'New York City, USA',
'name': 'Canary Benefits, Inc.',
'size': 'Under 25 employees',
'type': 'Fintech Company'}],
'customer_advisories': 'Affected individuals notified by mail with steps to '
'protect themselves',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['First and last name',
'Social Security number']},
'date_detected': '2025-12',
'date_publicly_disclosed': '2025-12-17',
'description': 'Shamis & Gentile P.A. is investigating the Canary Benefits, '
'Inc. data breach, where sensitive personally identifiable '
'information may have been exposed. Affected individuals may '
'be eligible for compensation.',
'impact': {'data_compromised': 'Sensitive personally identifiable information',
'identity_theft_risk': 'High'},
'investigation_status': 'Ongoing (under investigation by Shamis & Gentile '
'P.A.)',
'recommendations': ['Enroll in free 24 months of credit monitoring and '
'identity theft protection services (Cyberscout)',
'Review credit reports and account statements for '
'unauthorized activity',
'Place a fraud alert or credit freeze on your credit file',
'Report suspicious activity to financial institutions, '
'law enforcement, and the FTC',
'Retain documentation related to the breach and '
'suspicious activity'],
'references': [{'source': 'Shamis & Gentile P.A.'}],
'regulatory_compliance': {'regulatory_notifications': ['Massachusetts '
'Attorney General’s '
'office']},
'response': {'communication_strategy': 'Notification by mail to affected '
'individuals',
'third_party_assistance': 'Cyberscout (TransUnion) for credit '
'monitoring and identity theft '
'protection'},
'title': 'Canary Benefits, Inc. Data Breach Investigation',
'type': 'Data Breach'}