McCoyd Data Breach Notice (Indiana Attorney General): What Was Exposed & What To Do

Two people in Indiana were told their personal information was involved in a data security incident at McCoyd. The organization filed notice with the Indiana Attorney General on June 11, 2026, stating the incident itself occurred on May 13, 2026. Even when the number of people named is small, the practical concern is the same: once personal information leaves the systems meant to protect it, individuals face lasting questions about identity misuse, unwanted contact, and the need to monitor accounts and records.

Public reporting on this matter rests on that state filing. Details beyond the date of the incident, the date of the notice, the count of people affected, and the broad category of data described as personal information remain limited in the disclosure.

Breaking down the breach

According to the filing reported to the Indiana Attorney General, McCoyd notified Indiana residents of a data breach. The notice places the underlying incident on May 13, 2026, and the filing itself is dated June 11, 2026. The filing states that two people were affected. The data involved is described in the breach notification as personal information. No further breakdown of how the incident was discovered, what systems were involved, whether data was exfiltrated or only accessed, or what containment steps followed appears in the disclosed summary.

Scale, technical method, and any forensic findings are undisclosed in the available notice. The record does not attribute the event to a named threat group, nor does it describe ransomware, phishing, a misconfigured database, or any other specific vector. Readers should treat only the dates, the affected-person count of two, and the stated category of personal information as established by the filing.

How a breach like this happens

Incidents that lead to notices about personal information typically begin when an unauthorized party gains a foothold in an organization’s network or cloud environment, or when data is exposed through a configuration error, lost device, or compromised account. Common pathways include stolen or guessed credentials, malicious email that tricks an employee into running software or revealing passwords, unpatched software flaws, or overly broad access permissions that allow a limited compromise to reach more records than intended.

Once inside or once data is reachable, the unauthorized party may copy files, export database records, or simply view information. Organizations then investigate, determine whose records were involved, and—when state law requires it—notify residents and regulators. The timeline between an incident date and a public filing often reflects investigation, legal review, and the preparation of notices rather than the moment of first detection alone. None of these general patterns is confirmed as the cause in the McCoyd filing; they are background on how events of this type commonly unfold when no specific method is published.

Who is McCoyd?

McCoyd is the organization named in the Indiana Attorney General breach notice. Public detail in the filing does not expand on its full legal name, industry niche, or locations beyond the fact that it notified Indiana residents. Organizations that file such notices generally hold records about clients, customers, employees, or other individuals in the course of ordinary business—records that can include names, contact details, and other identifiers grouped under “personal information.”

A breach notice from any organization that maintains personal data matters because the people named in the notice must decide how to protect themselves, and because regulators track these events to understand patterns of risk across the state. The consequential point here is not a judgment about McCoyd’s security practices—the filing does not establish negligence—but the simple fact that two residents were told their information was involved and therefore may need to take ordinary protective steps.

The information in question

The breach notification describes the exposed data as personal information. The filing does not list specific fields such as Social Security numbers, driver’s license numbers, financial account details, medical information, or dates of birth. Because those particulars are not disclosed, it is accurate only to say that personal information was involved and that the exact data elements remain unconfirmed in the public notice.

Organizations that serve individuals commonly maintain names, addresses, phone numbers, email addresses, account or case identifiers, and sometimes government ID numbers or financial data depending on their line of work. Whether any of those more sensitive elements were present in this incident is not stated. Affected people should rely on the notice they received from McCoyd for the most precise description of what applied to them, rather than on assumptions drawn from typical industry practice.

What's at stake

For the two people named, the real-world risk centers on misuse of whatever personal information was involved. Even limited data can support targeted phishing, account takeover attempts, or fraudulent applications if it is combined with other information already available elsewhere. Monitoring credit reports, financial statements, and unexpected account activity becomes a reasonable precaution. Emotional and time costs—sorting mail, placing fraud alerts, answering verification calls—are also part of the practical impact, even when the absolute number of people affected is small.

For the organization, a reported incident brings notification duties, potential regulatory follow-up, and the need to review how personal information is stored and accessed. The filing itself does not assign fault or describe financial loss. The stake is continuity of trust and the obligation to inform people whose data may have been exposed so they can act.

What to do if you're exposed

If you received a notice from McCoyd, or if you believe you may be one of the two people referenced, start with the letter or email you were sent: it should describe what the organization knows about your information and any support it is offering, such as credit monitoring. Place a fraud alert or credit freeze with the major credit bureaus if you are concerned about new-account fraud. Review bank, credit card, and other account statements for unfamiliar activity, and change passwords on important accounts, especially if you reused credentials tied to the organization. Keep the notice for your records in case questions arise later with banks or agencies.

You can also run a free exposure scan of your email address to check whether that address has appeared in known breach data sets circulating online. That check does not replace official notice from McCoyd, but it can help you see whether the same email has shown up in other incidents and decide where to tighten security next. Stay alert to unsolicited calls or messages that reference the breach and ask for sensitive details; legitimate help will not require you to pay fees or surrender passwords over the phone.

AICompiled with AI assistance from public sources and published under our editorial standards.