Communications Data Group reports data breach affecting over 40,000 individuals

Illinois-based Communications Data Group said it suffered a significant data security incident that compromised the sensitive personal information of more than 40,000 individuals. 

 

Based in Champaign, Illinois, Communications Data Group offers billing and support services to telecommunications providers, including clients like Duo Broadband.

 

In a data security incident notice filed on behalf of Duo Broadband with the Office of Maine Attorney General, Communications Data Group said that on February 13, it was a victim of a ransomware attack where threat actors infiltrated its internal network, tried deploying malware to encrypt critical systems and demanded a ransom.

 

CDG immediately launched an investigation, with assistance from external cyber security experts, to determine the scope of the incident. It also took steps to secure the affected systems, terminated the unauthorised access, and notified law enforcement authorities about the incident.

 

“On March 17, 2025, we detected unauthorised access to certain sensitive personal information of Duo Broadband customers,” CDG said. 

 

The compromised data included names, addresses, dates of birth, and Social Security Numbers. The filing with the Maine state regulator also states that CDG has identified at least 42,518 Duo Broadband customers impacted by the incident.

 

“We have promptly implemented enhanced security measures to strengthen our protocols and prevent future incidents. These actions include reinforcing access controls, conducting a comprehensive security review, and reevaluating our third-party vendor management processes,” CDG added.

 

While CDG found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through Kroll to all affected individuals.