Incident BriefingsICW Group social-engineering incident

ICW Group social-engineering incident

ICW reported that social engineering of one employee on May 1, 2026 enabled unauthorized access to a limited set of documents. It became aware May 19; investigators placed access during May 1–4.

Last modified

Summary

  • Environment: Employee access to company documents
  • Operational impact: Personal-information access or exposure reported; disruption not quantified
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 14, 2026; updated as evidence emerges.

What happened

ICW reported that social engineering of one employee on May 1, 2026 enabled unauthorized access to a limited set of documents. It became aware May 19; investigators placed access during May 1–4. [1]

Impact

ICW determined November 5 that personal information was present in potentially accessed documents. Its public sample does not identify the recipient-specific data categories or affected-person total. [1]

Timeline

  1. Social-engineering event discovered

    Social-engineering event discovered.

    [1]

  2. Personal-information impact determined

    Personal-information impact determined.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on November 14, 2026.

Threat Group & Attack Vector

ICW describes social engineering of an employee but does not identify the communication channel or specific authentication mechanism. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific ATT&CK technique is mapped from the available evidence.

Response

ICW engaged forensic specialists, notified law enforcement and offered 24 months of credit monitoring and identity protection. It reported no evidence of fraudulent use. [1] See the notification.