CFGI Data Breach (2026): What Was Exposed & What To Do

What happened

On 6 March 2026, CFGI confirmed it had been targeted in an extortion campaign that concluded with the public release of data described as corporate contact information. The material included 243,000 unique email addresses along with names, phone numbers, and physical addresses. The affected population is stated as 248,000 individuals. No further technical details on the intrusion method or the precise volume of records have been disclosed.

How a breach like this happens

Incidents of this type often begin with unauthorized access to an organization’s systems or cloud storage containing employee or client directories. Once data are removed, the operators contact the victim and demand payment in exchange for deleting the copies. When payment is not made or negotiations fail, the material is posted on public forums or leak sites. The process relies on the fact that many organizations store aggregated contact lists that are valuable for follow-on campaigns but are not always segmented or monitored at the same level as financial or health records.

Who is CFGI?

CFGI provides financial consulting and advisory services to corporate clients. Firms in this sector routinely collect and retain names, job titles, employers, email addresses, phone numbers, and physical addresses of employees, clients, and business partners. A compromise at such an organization is consequential because the records can be used to map professional networks and to direct further contact attempts at individuals whose details appear in multiple business contexts.

What was likely exposed

The information reported as released consists of email addresses, names, phone numbers, physical addresses, employers, and job titles. These categories match the types of corporate contact data commonly held by advisory firms. The exact scope of any additional records that may have been accessed remains unconfirmed beyond the material that was publicized.

What's at stake

For individuals, the primary exposures are an increased volume of unsolicited messages and the potential use of verified contact details in targeted phishing or social-engineering attempts. Because the records also contain employer and job-title information, they can support more credible impersonation of colleagues or clients. For the organization, the incident adds to the body of publicly available evidence that its systems were accessed, which may affect client confidence and trigger regulatory notification obligations depending on jurisdiction and contract terms.

If your data was in this breach

Individuals whose information appears in the released material should treat unsolicited messages that reference their employer or job title with heightened caution. Standard steps include reviewing account security settings, enabling multi-factor authentication where available, and monitoring for unusual login attempts. Readers can also run a free exposure scan of their email address against known breach data to determine whether their details have appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.