What Happened in the RTX Corporation Data Breach?
RTX Corporation, the aerospace and defense company formerly named Raytheon Technologies, has told affected individuals that intruders gained unauthorized access to sensitive personal records. The company disclosed the incident in a notice filed with the Massachusetts Attorney General’s Office. This filing confirms that the RTX Corporation data breach involved real exposure of personal data, not just a suspected intrusion.
According to the filing, unauthorized access occurred in June 2026. RTX has not released details about how the intrusion happened or whether it has identified a specific attacker. As a result, many open questions remain about the technical cause of this event.
RTX’s internal investigation ran through most of July 2026 before the company finalized its notification letters. During that review, investigators worked to determine exactly which individuals were affected and which data categories were involved. This process, while thorough, meant that affected people had no way to protect themselves until notice finally went out.
Notably, RTX has faced other cybersecurity incidents in recent years, including a 2025 ransomware attack that disrupted airport-related services tied to a different part of its business. However, this latest event appears to be a separate matter entirely. The dates involved and the nature of the exposed information differ significantly from that earlier disruption.
Who was affected?
RTX describes the affected population simply as individuals whose personal information was involved in the incident. The notification letter does not specify whether those affected are customers, employees, contractors, or another group tied to RTX’s operations. Because RTX is one of the largest defense and aerospace contractors in the world, the pool of people whose data it holds is substantial.
The exact number of affected individuals has not been publicly disclosed. Given the company’s size and reach, however, even an incident described in general terms could touch a meaningful number of people across multiple states. There is no indication in the notice of whether minors are among those affected.
Large contractors like RTX manage data belonging to a wide network of people connected to government and commercial work. Consequently, breaches at companies of this scale often carry broader consequences than a typical retail or service-sector incident. Affected individuals should assume their information could be tied to sensitive employment or contractual relationships, even though this breach involved personal rather than classified information.
What Information Was Potentially Exposed?
Based on RTX’s own investigation, three categories of personal data were confirmed as exposed. This combination is especially concerning because it gives bad actors nearly everything needed to attempt identity theft.
- Full first and last names
- Mailing addresses
- Social Security numbers
Social Security numbers stand apart from other types of compromised data because they function as a lasting identifier. Unlike a password or a card number, a Social Security number cannot simply be replaced after exposure. Therefore, individuals affected by this breach may face risk that lingers for years, not just weeks or months.
When a full name and address are paired with a Social Security number, fraudsters gain the tools to open new credit accounts, file fraudulent tax returns, or apply for government benefits under someone else’s identity. This is a more severe combination than data breaches involving only login credentials or partial account numbers. As a result, affected individuals should treat this notification seriously and act promptly, even though RTX says it has found no confirmed misuse so far.
What is the company doing?
RTX says it completed an internal investigation to confirm which individuals were affected and what specific data was involved. Once that review concluded, the company began sending written notification letters in July 2026. RTX states it is not aware of any confirmed misuse of the exposed information at this time.
As a protective measure, RTX is offering free credit monitoring and identity protection services to affected individuals. Specifically, the company is providing enrollment in Equifax Complete Premier, with a deadline of October 31, 2026. This service can help detect certain fraudulent activity, although it does not undo the underlying exposure of Social Security numbers.
What Should Affected Individuals Do?
Enroll in the Free Credit Monitoring Offered
If you received a letter from RTX, sign up for the complimentary Equifax Complete Premier monitoring before the October 31, 2026 deadline. This service can alert you quickly if someone tries to open new credit in your name.
Even so, monitoring only catches problems after they start. Because of this, affected individuals should pair enrollment with their own independent efforts to watch financial and tax activity going forward.
Place a Fraud Alert or Credit Freeze
Because Social Security numbers were exposed, consider placing a credit freeze or fraud alert with Equifax, Experian, and TransUnion. A freeze blocks new creditors from accessing your file, which makes it much harder for anyone to open accounts in your name.
A fraud alert, meanwhile, requires lenders to verify your identity before extending credit. Both options are free to set up, and either step adds a meaningful layer of protection while the risk from this breach remains active.
Review Your Credit Reports and Financial Accounts
Regularly review your credit reports from all three major bureaus for accounts or inquiries you do not recognize. In addition, check your bank and credit card statements often for unfamiliar charges.
Because tax fraud is a common outcome of Social Security number theft, also watch for unexpected notices from the IRS or state tax agencies. Filing your taxes early each year can help prevent someone else from filing a fraudulent return using your identity.
Stay Alert for Phishing Attempts
Breach notifications like this one often trigger a second wave of scams. Scammers may pose as RTX, a credit monitoring provider, or a government agency to trick anxious recipients into giving up even more personal information.
Before clicking any link or calling any number referencing this breach, verify the source independently. If a message asks you to confirm your Social Security number or account details, treat it with suspicion, since legitimate notices rarely request that information by email or text.
Consider Filing a Police Report or Consulting an Attorney
If you discover signs of identity theft connected to this breach, Massachusetts law allows affected residents to file a police report. Having documentation can support both fraud disputes and any potential legal claims.
You may also want to speak with a data breach attorney about your options. An attorney can help you understand whether you qualify for compensation and what evidence you should gather to support a claim.