Castle Group Data Breach Exposes Sensitive Personal Information Across Multiple States Castle Management, the parent company of Castle Group, a property management firm serving residential communities in Florida, Texas, Colorado, Tennessee, and the Carolinas, has reported a data breach involving unauthorized access to its network. The incident occurred between September 2025 and February 2026, with the company confirming the exposure of sensitive data on August 11, 2026, following an investigation with cybersecurity professionals. The breach compromised a range of personal information, including: - Social Security numbers - Financial account details - Driver’s license numbers - Credit/debit card numbers - Government ID numbers - Health records - Names Affected individuals were notified via a sample breach notice, which disclosed the potential exposure of these records. Legal professionals and advocacy groups, including ClassAction.org, are investigating the incident to determine whether a class action lawsuit can be filed on behalf of impacted consumers. Such a lawsuit could seek compensation for privacy violations, financial losses, and other damages. The breach highlights ongoing risks in property management and third-party data handling, with potential long-term consequences for affected individuals. Further details remain under review as investigations continue.

Castle Group Discloses Ransomware Attack Exposing Sensitive Personal Data Castle Group, a Florida-based property management company overseeing residential communities nationwide, recently reported a data breach stemming from a ransomware attack. The incident, disclosed to state regulators on August 26, 2026, affected at least 38 Massachusetts residents and 5 Vermont residents, though the full scope remains unclear. Unauthorized access to Castle Group’s network occurred between September 2025 and February 2026, with the ransomware group Qilin claiming responsibility on February 17, 2026, via a dark web post. The breach exposed a range of sensitive personal data, including names, Social Security numbers, government IDs, financial account details, and health records. Following the discovery, Castle Group engaged external cybersecurity experts to conduct a forensic investigation, confirming the compromise of systems containing personal information. In response, the company is offering complimentary identity theft protection services through Cyberscout (a TransUnion subsidiary) to affected individuals, along with a dedicated toll-free response line for inquiries, available weekdays from 8 a.m. to 8 p.m. The incident highlights the ongoing threat of ransomware attacks targeting organizations handling sensitive consumer data.