---
title: "ICW Group social-engineering incident"
description: "ICW reported that social engineering of one employee on May 1, 2026 enabled unauthorized access to a limited set of documents. It became aware May 19; investigators placed access during May 1–4."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-14"
canonical_url: "https://www.ally.security/incidents/icw-group-social-engineering-incident-2026"
markdown_url: "https://www.ally.security/incidents/icw-group-social-engineering-incident-2026.md"
stix_url: "https://www.ally.security/incidents/icw-group-social-engineering-incident-2026/stix.json"
---

# ICW Group social-engineering incident

ICW reported that social engineering of one employee on May 1, 2026 enabled unauthorized access to a limited set of documents. It became aware May 19; investigators placed access during May 1–4.

Last modified Nov 14, 2026 · 1 source

## Summary

- **Environment:** Employee access to company documents
- **Operational impact:** Personal-information access or exposure reported; disruption not quantified
- **Financial impact:** No confirmed incident cost quantified

## What happened

[ICW](https://www.icwgroup.com/) reported that social engineering of one employee on May 1, 2026 enabled unauthorized access to a limited set of documents. It became aware May 19; investigators placed access during May 1–4. [1](#source-1)

## Impact

ICW determined November 5 that personal information was present in potentially accessed documents. Its public sample does not identify the recipient-specific data categories or affected-person total. [1](#source-1)

## Timeline

### May 19, 2026 — Social-engineering event discovered

Social-engineering event discovered. [1](#source-1)

### November 5, 2026 — Personal-information impact determined

Personal-information impact determined. [1](#source-1)

### November 14, 2026 — Briefing updated

This briefing was last reviewed and updated on November 14, 2026.

## Threat Group & Attack Vector

ICW describes social engineering of an employee but does not identify the communication channel or specific authentication mechanism. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

ICW engaged forensic specialists, notified law enforcement and offered 24 months of credit monitoring and identity protection. It reported no evidence of fraudulent use. [1](#source-1) See the [notification](https://oag.ca.gov/system/files/Individual%20Notification%20-%20ICW%20-%20NOV%202026_0.pdf).

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/icw-group-social-engineering-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### ICW Group Holdings, Inc. security incident notice

official · ICW Group Holdings, Inc.

<https://oag.ca.gov/system/files/Individual%20Notification%20-%20ICW%20-%20NOV%202026_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Social-engineering event discovered: 2026-05-19
2. **Occurred At · 100% confidence · current**  
   Personal-information impact determined: 2026-11-05
3. **Resulted In · 100% confidence · current**  
   ICW Group social-engineering incident: ICW engaged forensic specialists, notified law enforcement and offered 24 months of credit monitoring and identity protection. It reported no evidence of fraudulent use.
4. **Began At · 100% confidence · current**  
   ICW Group social-engineering incident: 2026-05-01
5. **Discovered At · 100% confidence · current**  
   ICW Group social-engineering incident: 2026-05-19
6. **Affected Organization · 100% confidence · current**  
   ICW Group social-engineering incident: ICW Group Holdings, Inc.
7. **Ended At · 100% confidence · current**  
   ICW Group social-engineering incident: 2026-05-04
8. **Resulted In · 100% confidence · current**  
   ICW Group social-engineering incident: ICW determined November 5 that personal information was present in potentially accessed documents. Its public sample does not identify the recipient-specific data categories or affected-person total.
9. **Resulted In · 100% confidence · current**  
   ICW Group social-engineering incident: ICW reported that social engineering of one employee on May 1, 2026 enabled unauthorized access to a limited set of documents. It became aware May 19; investigators placed access during May 1–4.
10. **Resulted In · 100% confidence · current**  
   ICW Group social-engineering incident: Personal-information impact determined
11. **Resulted In · 100% confidence · current**  
   ICW Group social-engineering incident: Social-engineering event discovered

</details>