---
title: "Porter & Company website data incident"
description: "Porter & Company disclosed possible personal-information access through its website on two dates in August and September 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-16"
canonical_url: "https://www.ally.security/incidents/porter-company-website-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/porter-company-website-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/porter-company-website-data-incident-2026/stix.json"
---

# Porter & Company website data incident

Porter & Company identified activity indicating unauthorized website access around August 30, 2026.

Last modified Oct 16, 2026 · 1 source

## Summary

- **Environment:** Company website and stored personal information
- **Operational impact:** No operational outage established in the reviewed notice
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Porter & Company LLC](https://app.porterandcompany.com/) is the affected organization.

Porter & Company identified activity indicating unauthorized website access around August 30, 2026. [1](#source-1)

## Impact

The investigation determined on October 6 that files containing personal information may have been accessed or acquired for periods of hours on August 30 and September 11. [1](#source-1)

The public notice redacts the affected data categories and gives no affected-person count. It does not establish continuous access between those dates.

## Timeline

### October 6, 2026 — Data-impact finding reached

The investigation identified possible personal-information access or acquisition on two earlier dates. See the [source notice](https://oag.ca.gov/system/files/Redacted_-_Porter__Company_-_Adult_No_CM_Notice_Letter_Template%2840257131.2%29_V2_40289983v1.pdf). [1](#source-1)

### October 16, 2026 — Briefing updated

This briefing was last reviewed and updated on October 16, 2026.

## Threat Group & Attack Vector

The notice identifies the website as the affected environment but does not establish how the unauthorized party entered.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The company secured its website, investigated with external cybersecurity professionals and provided an assistance line and identity-protection guidance. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/porter-company-website-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Porter & Company notice of data breach

official · Porter & Company LLC

<https://oag.ca.gov/system/files/Redacted_-_Porter__Company_-_Adult_No_CM_Notice_Letter_Template%2840257131.2%29_V2_40289983v1.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Data-impact finding reached: The investigation identified possible personal-information access or acquisition on two earlier dates.
2. **Occurred At · 100% confidence · current**  
   Data-impact finding reached: 2026-10-06
3. **Resulted In · 100% confidence · current**  
   Porter & Company website data incident: The company secured its website, investigated with external cybersecurity professionals and provided an assistance line and identity-protection guidance.
4. **Resulted In · 100% confidence · current**  
   Porter & Company website data incident: The investigation determined on October 6 that files containing personal information may have been accessed or acquired for periods of hours on August 30 and September 11.
5. **Affected Organization · 100% confidence · current**  
   Porter & Company website data incident: Porter & Company LLC
6. **Resulted In · 100% confidence · current**  
   Porter & Company website data incident: Porter & Company identified activity indicating unauthorized website access around August 30, 2026.
7. **Resulted In · 100% confidence · current**  
   Porter & Company website data incident: Data-impact finding reached

</details>