Tower Administrative Services toweradministrative.com Tower Administrative Services data breach: what happened and what to do
Tower Administrative Services detected a cyberattack in February 2026. Its notice says names, addresses, Social Security numbers and financial account information may have been involved, depending on the person.
View all 13,115 breaches- Breach date
- 3 Feb 2026
- Data exposed
- Names, Physical addresses, Social security numbers, Financial account information
- Last updated
What happened
Tower Administrative Services, a Pennsylvania company, has told state attorneys general that it suffered a cyberattack. Its notice says it detected suspicious network activity on February 4, 2026, and that unauthorized access happened on or around February 3.
According to its notification letters, the company finished reviewing which files were affected on May 20, 2026, and began mailing letters on June 23. What was involved varies by person. The notice says it may include names, addresses, Social Security numbers and financial account information.
The breach appears on the California and Washington Attorney General notification lists. Washington's entry shows 868 residents of that state, but that's one state only, so it isn't the total. Press and law-firm reports give other counts, which differ from each other, and no total has been published.
Tower's letter says it has no evidence that any information has been misused. It offers free credit monitoring and identity protection through Cyberscout and Identity Force, which people have to sign up for within 90 days of receiving the letter, using the activation code in it.
A Social Security number doesn't change. With a name and address it's enough to open credit in someone else's name, file a false tax return or take over a financial account, which is why credit freezes are the first step below. A lawsuit has been filed over the breach, and no court has ruled on its claims and no settlement has been reported.
What to do if you were in it
- 1
Use the free monitoring if you got a letter
The notice offers credit monitoring through Cyberscout and Identity Force. You have to enroll within 90 days of getting your letter, using the code on it.
- 2
Freeze your credit
A freeze at Equifax, Experian and TransUnion is free and stops new accounts being opened in your name. You can lift it when you need credit.
- 3
Watch your statements and tax account
Check bank and card statements for charges you don't recognize. Consider an IRS Identity Protection PIN so no one else can file a return with your Social Security number.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web for your email, phone number and passwords, and alerts you when they show up. You can run a free scan at serus.ai. Serus can't remove data from a breach, but it tells you what to change.
Frequently asked
Was I affected by the Tower Administrative Services breach?
If you got a notice letter from Tower, yes. The company says the data involved varies by person. If you didn't get a letter, you can still run a free Serus scan to see whether your email or phone shows up in other breaches.
What was exposed?
Tower's notice says names, addresses, Social Security numbers and financial account information may have been involved, depending on the individual.
Is there a settlement?
No settlement has been reported. A lawsuit was filed in June 2026, and no court has ruled on it.
Should I change my password?
The notice doesn't mention passwords. Your Social Security number and financial account details are the bigger issue, so freeze your credit and watch your accounts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
