1336 Discloses Data Breach to Indiana Regulators in January 2026

Tech company 1336 reported a data breach to Indiana authorities on January 7, 2026, following an incident that occurred in December 2025. The breach exposed various types of personal information, including names, email addresses, and payment card details. Individuals affected by this incident should take steps to protect their compromised data.

State: Indiana
Breach date: December 3, 2025
Reported: January 7, 2026

What may have been exposed

Full Name
Email Address
Password or Credential Hash
Mailing Address
Purchase and Order History
Payment Card Information
Account Username
IP Address and Connection Logs

On January 7, 2026, 1336 filed an official notice with Indiana regulators regarding a data security incident. This breach, which reportedly began on December 3, 2025, involved the compromise of digital information held by the company. The specific details surrounding the cause of the breach were not fully specified in the public filing, which is currently under monitoring for further developments.

The disclosed information reportedly includes Full Name, Email Address, Password or Credential Hash, Mailing Address, Purchase and Order History, Payment Card Information, Account Username, and IP Address and Connection Logs. This range of data could be significant for those individuals whose records were part of the breach.

Exposure of these data types can lead to several risks. For instance, compromised email addresses and password hashes could be used in 'credential stuffing' attacks, where attackers attempt to use these combinations on other online services. Mailing addresses, coupled with purchase history, might make individuals vulnerable to targeted phishing scams or social engineering attempts.

To help mitigate potential risks, it is advisable for individuals who have received a notification from 1336 to monitor their online accounts closely. Changing passwords for any accounts associated with 1336, especially if similar passwords are used elsewhere, is a recommended security measure. Enabling multi-factor authentication (MFA) on all available online services can add an extra layer of protection.

Additionally, individuals should remain vigilant against any unsolicited communications that request personal information or financial details. Carefully reviewing transaction statements and account activity for any suspicious behavior is also an important step to take after such a data breach.

What to do if you were affected

Based on the categories of information reported in this filing, these steps can help limit the risk of identity theft and fraud.

Watch your financial accounts
Review bank and card statements for unfamiliar activity and turn on transaction alerts. Report anything you don't recognize to your bank right away.
Secure your online accounts
Change the password on any account that reused an exposed password and turn on two-factor authentication wherever it's offered.
Stay alert to targeted scams
Be cautious of calls, texts, or emails that reference this breach. Legitimate organizations won't ask you to confirm sensitive details through an unsolicited message.
Keep your notification letter
Save the notice you received. It documents that your information was involved and is often needed to enroll in any credit monitoring offered or to join a related legal claim.

Source: Indiana Attorney General filing

Related data breach cases

Browse all Indiana data breaches View the full case directory