April 2026

We discovered an IT security incident in late March 2026 in which an unauthorised third-party used stolen credentials to access some of our systems.

We have been working with third-party security specialists to forensically investigate the incident, the systems, and any data involved. These investigations are ongoing, but I wanted to update our customers and partners on the situation and how we're addressing it.

We believe that the incident has been contained and that unauthorised access to our systems has been remediated. We have been taking all required steps to comply with our legal and regulatory obligations and notify the relevant authorities, including law enforcement.

Because we take security incredibly seriously at The Adaptavist Group, our processes are robust and we operate on principles of role-based access for systems and least privilege for customer data to reduce the scope of any potential unauthorised access. We are certified under ISO27001 and SOC2, and the controls in place under these standards did their job.

The systems accessed contained typical business data such as that which you would expect to find on a business card: name, business email address, job role, contact number, organisation, etc.

Following an unsuccessful extortion attempt using data stolen from these systems, we cannot rule out the possibility that the third party will now choose to name us and publish that data on the dark web.

Whilst I realise that incidents are never welcome and it's never pleasant to receive news of them, I would like to reassure customers and partners that there is no sign of, nor reason to believe that there was any access to client systems, data that we process on behalf of clients, or our production systems.

Some reflections from me as we move onwards: the tight culture of The Adaptavist Group, where we can solve problems in the moment backed by policy and a strong philosophy of doing the right thing is something I am fiercely proud of.

The teams at The Adaptavist Group have pulled together to work this incident with a speed and diligence that gives me great confidence as CEO.

Finally, thank you for your continued support and partnership.

Simon

—

CEO, The Adaptavist Group