What Happened in the Hillwood Development Company Data Breach?
Hillwood Development Company, LLC, an industrial real estate developer with projects across the country, recently told affected individuals about a network intrusion that put their personal records at risk. The company builds and manages large commercial properties, and that work requires it to hold data on employees, contractors, tenants, and other people tied to its projects. This breach shows how much sensitive information a firm like this can accumulate over time.
According to the notification, unauthorized access to Hillwood’s network occurred in March 2026. The company says it identified the intrusion just two days later, which points to some level of active monitoring already in place. Once the incident was found, Hillwood worked with outside cybersecurity specialists to contain it that same day, limiting how much further damage could occur.
Beyond containment, Hillwood also brought in outside legal counsel to guide its response and notified law enforcement about the incident. The company has cooperated with the resulting investigation into what happened. However, Hillwood has not publicly shared how the attacker got in or whether investigators have linked the intrusion to a specific hacking group.
Because the incident involved several categories of sensitive data at once, the forensic review needed to sort out exactly whose information was affected likely took considerable time. This is common after breaches involving a mix of financial, health, and identity data. As a result, notification letters went out only after Hillwood had a clearer picture of what was exposed and for whom.
Who was affected?
The people affected by this breach appear to be clients of Hillwood Development Company, LLC, along with others connected to the company’s real estate operations. Given that Hillwood operates in multiple states, the exposure likely reached individuals well beyond a single region. Real estate developers of this size typically maintain records tied to people across many different markets rather than one local office.
Hillwood has not publicly disclosed the total number of people affected by this incident. Therefore, anyone unsure whether they are included should watch for a direct notification letter rather than assume they were left out. Because the compromised data includes health information alongside financial details, it’s possible that both individual clients and other parties connected to Hillwood’s business dealings were caught up in the exposure.
What Information Was Potentially Exposed?
Hillwood’s notification describes a broad set of personal data categories that may have been compromised, though the exact combination varies from person to person. Anyone who receives a letter should review it closely to see which categories apply specifically to them.
- Full names
- Home addresses
- Social Security numbers
- Dates of birth
- Driver’s license or other government-issued ID numbers
- Financial or payment card account numbers
- Health information
- Digital signatures
When a breach combines identifiers like Social Security numbers with driver’s license numbers, the risk grows substantially. Together, these can help a criminal pass identity verification checks used by banks, lenders, and government agencies. This means someone impersonating a victim could potentially open new accounts or file official documents in that person’s name.
The presence of financial account numbers adds another layer of concern, since it raises the possibility of unauthorized charges on existing accounts. Meanwhile, exposed health information creates a separate risk of medical identity theft, where a criminal uses someone else’s identity to obtain treatment or file fraudulent insurance claims. Because these categories often surface risk on different timelines, affected individuals may not see warning signs immediately after the breach.
What is the company doing?
In response to the incident, Hillwood contained the intrusion on the day it was discovered, working alongside cybersecurity experts brought in specifically for this purpose. The company also engaged outside legal counsel and notified law enforcement, showing a fairly structured incident response process. These early steps were aimed at limiting further unauthorized access and preserving evidence for the investigation.
Following containment, Hillwood began notifying individuals whose information may have been involved and filed notice with at least one state attorney general’s office. To help affected people guard against misuse of their data, the company is offering free enrollment in Experian IdentityWorks, which includes credit monitoring and identity restoration services for 24 months. This offer gives affected individuals a tool to catch suspicious activity, though it does not undo the fact that their information was exposed in the first place.
What Should Affected Individuals Do?
Enroll in Free Credit Monitoring
Anyone who received a notification letter should sign up for the free Experian IdentityWorks credit monitoring and identity restoration services before the enrollment deadline. This service can alert you to new accounts, inquiries, or changes tied to your credit file. Because enrollment is time-limited, it’s worth acting soon rather than setting the letter aside.
Credit monitoring won’t stop a thief from attempting to use your information, but it can shorten the amount of time before you notice misuse. Catching fraud early often makes it easier to dispute charges and limit financial damage. For that reason, enrolling promptly gives you a meaningful head start.
Consider a Credit Freeze or Fraud Alert
Because Social Security numbers, driver’s license numbers, and financial account details were all potentially exposed, placing a security freeze on your credit file is a strong protective step. A freeze blocks new creditors from accessing your credit report, which makes it much harder for someone to open new accounts in your name. You can request a freeze separately with Equifax, Experian, and TransUnion.
Alternatively, a fraud alert requires lenders to take extra steps to verify your identity before extending credit. This option is less restrictive than a freeze but still adds a layer of protection. Either way, acting on this now can help prevent long-term financial headaches later.
Monitor Financial and Health Records Closely
Given that both financial account numbers and health information were potentially exposed, it’s important to review more than just your credit report. Check your bank and credit card statements regularly for charges you don’t recognize. In addition, review any health insurance explanation-of-benefits statements for services you never received.
Medical identity theft can be harder to detect than financial fraud because it doesn’t always show up on a credit report. Instead, warning signs might appear as unfamiliar claims or unexpected bills from a provider you never visited. If you notice anything unusual, contact your insurer and the provider immediately to dispute it.
Stay Alert for Phishing Attempts
After any major data breach, scammers often send emails or make calls pretending to represent the breached company or a credit monitoring provider. Because your contact information may have been included in the exposed data, you should treat unexpected messages about this incident with caution. Never click links or share personal details without verifying the source first.
If you receive a suspicious message referencing this breach, contact Hillwood or Experian directly using verified contact information rather than anything provided in the message itself. This extra step of verification can prevent you from handing over even more personal data to a scammer. Staying cautious for months after a breach notification is wise, since criminals sometimes wait before acting on stolen data.