Hello. Boston Capital, which invests in the development of affordable housing, is this week notifying thousands of people in at least five states that their Social Security numbers and other personal data was breached in January.

The company didn’t detect the breach itself; it found out when hackers made data-theft claims online, which prompted Boston Capital to investigate. The company didn’t go into detail in its disclosures to state regulators about its cybersecurity measures, so we don’t know about any intrusion-detection systems it might have had in place. 

This isn’t an unusual situation but it is a concerning one. Hackers are good at slipping in and out unnoticed, often by way of abusing legitimate credentials and acting like insiders.

Readers, I’d love to hear from you: What work flows or tools can make companies better at spotting potentially “bad” insider activity? Email me with your thoughts.

More news below.

Federal financial regulators are holding off on cybersecurity assessments of big banks while the firms assess the capabilities of Anthropic's Mythos, Bloomberg reported, citing people familiar with the situation. The Federal Reserve and Office of the Comptroller of the Currency are also discussing how best to address threats and vulnerabilities identified by the AI model.

Companies continue to fall behind in patching, with exploitation of known vulnerabilities the primary way hackers hacked last year, according to Verizon. Exploited bugs accounted for 31% of breaches in the 12 months ending in October 2025, up from 20% in the prior period, Verizon said Tuesday in its annual data breach investigations report. (CyberScoop)

• The median time from detection to patching was 43 days, up from 32 days the year earlier. Verizon analyzed more than 22,000 breaches in its latest research.

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.