Where does the UpMarket case file come from?

Every entry is taken from the breach report UpMarket lodged with the Massachusetts Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: UpMarket Data Breach

This file collects the dated facts on record for the UpMarket incident. The state report is dated June 26, 2025.

Timeline

June 26, 2025Report filed in MassachusettsDate the notice was lodged with the Massachusetts Attorney General.

Case facts

Filing state: Massachusetts
Date reported: June 26, 2025
Receiving office: Massachusetts Attorney General

Case notes

On June 26, 2025, UpMarket, a sophisticated digital marketplace and investment platform, filed a report with the Massachusetts Attorney General regarding a data security incident. The company's operations involve handling extensive amounts of highly sensitive consumer and financial information to facilitate high-value transactions and manage investments.

The filing describes a "significant data security incident" that has impacted its digital infrastructure. While specific details about the breach type are not yet public, such incidents often involve unauthorized access to systems holding confidential data. UpMarket has stated that an investigation into the incident is ongoing to determine the full scope of the compromise.

The exposure of personal information from a platform like UpMarket carries significant risks for affected individuals. While the specific categories of the information involved have not been detailed, the nature of UpMarket's business suggests that sensitive personal and financial information could be at risk. This situation increases the potential for identity theft, unauthorized account access, and targeted fraudulent activities.

Individuals who receive a notification from UpMarket should review the letter carefully for any specific guidance provided. It is generally advisable to remain vigilant for suspicious activity across all personal accounts and to consider implementing strong, unique passwords for online services. Monitoring credit reports and financial statements for any unfamiliar transactions is also a recommended precaution following any data security incident.

As a commercial entity operating in Massachusetts and handling sensitive data, UpMarket is subject to the Massachusetts Data Security Regulations (201 CMR 17.00). The company's filing with the Attorney General's office is part of its regulatory obligations following a data security incident within the Commonwealth.

Questions about this case file

Where does the UpMarket case file come from?: Every entry is taken from the breach report UpMarket lodged with the Massachusetts Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Massachusetts data breaches

Timeline

Case facts

Case notes

Questions about this case file

More Massachusetts case files