Punch & Associates Data Breach

A ransomware group says it stole passport numbers, Social Security numbers, and financial records belonging to an investment firm’s clients and employees. Punch & Associates Investment Management has only confirmed that three Vermont residents were affected.

Punch & Associates Investment Management, Inc., a boutique investment advisory firm based in the Minneapolis, Minnesota area, has confirmed a data breach involving Social Security numbers and financial account codes. The confirmation came through a security breach notice filed with the Vermont Attorney General’s office on August 24, 2026, reporting 3 affected Vermont residents.

The notice came roughly three and a half months after the Akira ransomware group first claimed responsibility for an attack on Punch & Associates. According to security researchers who track ransomware group claims, Akira posted on May 5, 2026 that it had stolen approximately 10 gigabytes of data from the firm, including client Social Security numbers, driver’s license numbers, and passport numbers, along with employee personnel files and confidential financial and business documents. Punch & Associates has not publicly confirmed the scope of Akira’s claims.

A Gap Between What Was Claimed and What Has Been Confirmed

Two figures matter here, and they do not match. Akira’s own claim, as reported by ransomware-tracking researchers, describes a broad haul touching passport numbers, driver’s license numbers, and business records for dozens of people. Punch & Associates’ official filing confirms only 3 Vermont residents and only two categories of data: Social Security numbers and financial account codes. Emery | Reddy has not independently verified Akira’s claims and presents them here only as the ransomware group’s own reported statements, not as confirmed fact. The size of that gap, and the roughly three and a half months between Akira’s claim and Punch & Associates’ official notice, are central to this investigation.

What Information Was Exposed?

The Vermont Attorney General’s notice confirms the following categories of information were involved:

• Social Security numbers
• Financial account codes

Akira’s own claims, not confirmed by Punch & Associates, reportedly also reference passport numbers, driver’s license numbers, employee personnel files, and confidential financial and business documents.

What Is Punch & Associates Offering?

Punch & Associates has not announced any credit monitoring, identity theft protection, or other remedy for affected individuals as of this writing.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Financial institutions are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Do You Have Legal Options?

Investment advisory firms have a legal duty to safeguard the client and employee information in their care. Individuals affected by this breach, whether the confirmed Vermont residents or others whose information may have been part of the broader data Akira claims to have taken, may have rights and remedies under applicable law.

If you are a current or former client or employee of Punch & Associates and believe your information was affected, contact the Data Breach Attorneys at Emery | Reddy for a Free Case Review.

Frequently Asked Questions

How many people were affected by the Punch & Associates data breach?

Punch & Associates has officially confirmed only 3 affected Vermont residents. The Akira ransomware group has claimed a much larger haul, reportedly touching dozens of people, but Punch & Associates has not confirmed that broader claim.

Who is the Akira ransomware group?

Akira is a ransomware group that has claimed responsibility for numerous attacks on businesses. Ransomware groups typically steal data before encrypting a victim’s systems, then threaten to publish the stolen data unless a ransom is paid. Akira publicly claimed responsibility for the Punch & Associates attack on May 5, 2026.

Why did it take so long for Punch & Associates to confirm the breach?

Punch & Associates’ official notice to Vermont came roughly three and a half months after Akira’s initial claim. Punch & Associates has not publicly explained the reason for that gap.

Is Punch & Associates offering credit monitoring?

Not as of this writing. Punch & Associates has not announced any credit monitoring, identity theft protection, or other remedy for affected individuals.

What should I do if I am a current or former Punch & Associates client or employee?

Watch your financial accounts and credit reports for unfamiliar activity. Consider placing a fraud alert or credit freeze on your credit file. Keep records of your relationship with Punch & Associates, and consider speaking with a data breach attorney about your options.

Do I have a legal claim?

You may. Investment advisory firms are required by law to protect the client and employee information in their care. Contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.