Upstream Advisory Group LLC, a North Carolina-based financial and employee benefits consulting firm, experienced a data breach in May 2025 after a phishing attack compromised one of its email accounts. An unauthorized third party accessed the account between May 21 and May 28, 2025, potentially viewing or exfiltrating emails containing personal information, including names paired with other identifying details (likely of employees or clients). The breach was discovered on August 19, 2025, prompting an investigation. The exposed data raises risks of identity theft, fraud, and unauthorized financial activity for affected individuals. A law firm, Edelson Lechtzin LLP, is pursuing a class-action lawsuit on behalf of victims, alleging negligence in safeguarding sensitive data. The incident highlights vulnerabilities in Upstream Advisory’s cybersecurity defenses, particularly against social engineering attacks targeting employee credentials.