What happened in the Case & Associates Properties data breach?

The Case & Associates Properties data breach involved unauthorized access to the network of the Tulsa-based real estate and property-management company. Case & Associates manages more than 30,000 residential units across six states. According to the company’s notice an unauthorized actor may have accessed its network environment for approximately six and a half months—from on or about September 1, 2025, until on or about March 16, 2026.

Case & Associates discovered the suspicious activity on or around March 14, 2026. The company says it immediately began containing the threat and securing its internal environment. Notably, the identified access period continued until approximately March 16, two days after the incident was discovered. Case & Associates then retained outside cybersecurity professionals to investigate the intrusion, determine which systems were affected and evaluate whether those systems contained personal or sensitive information.

Following a forensic investigation and manual review of the affected documents, Case & Associates determined on June 3, 2026, that the accessed systems contained personal information belonging to certain individuals. The company’s notice does not identify exactly how the attacker entered the network. It does not say whether the incident resulted from phishing, stolen credentials, ransomware, an unpatched vulnerability, a third-party service provider or another security failure. The notice also does not state whether the unauthorized actor copied, downloaded or removed information. Accordingly, the incident can accurately be described as unauthorized network access, but the specific cause and extent of any data removal remain undisclosed.

How did the Case & Associates Properties breach occur?

The precise cause of the Case & Associates Properties data breach has not been publicly disclosed. Case & Associates has not explained how the actor entered the network. The available information does not indicate whether the breach resulted from phishing, compromised credentials, ransomware, malware, a software vulnerability or a third-party vendor. The company also has not said whether information was copied, downloaded or removed. It therefore can be described as an unauthorized network intrusion, but the specific attack method remains unknown.

When did the Case & Associates Properties breach occur?

The Case & Associates Properties data breach occurred between approximately September 1, 2025, and March 16, 2026. The company discovered the suspected unauthorized network access on or around March 14, 2026.

How many people were affected by the Case & Associates Properties breach?

At least 932 Texas residents were affected by the Case & Associates Properties data breach. The total number of affected individuals nationwide has not been publicly disclosed, but is likely in the thousands.

What information was exposed in the Case & Associates Properties breach?

• Breached data reportedly may include, but is not necessarily limited to:
  • names
  • Social Security numbers

Has Case & Associates Properties offered free credit monitoring and/or identity theft protection services?

Yes, affected individuals are being offered complimentary Iris Identity Protection services. The offer is described as providing 24 months of one-bureau credit monitoring through Equifax, identity monitoring, identity-fraud insurance and identity-resolution assistance. Enrollment must be completed within 90 days of the July 13 notice. The enrollment website and individualized promotional code are redacted from the public copy. Although one later boilerplate sentence refers to “12-month” monitoring, the principal offer and enrollment section repeatedly specify 24 months, indicating that 24 months is the intended benefit period.

Case & Associates Properties data breach timeline:

Date	Event
On or about September 1, 2025	Unauthorized activity began.
On or about March 14, 2026	Case & Associates Properties discovered the incident.
On or about March 16, 2026	Unauthorized activity ended.
On or about June 3, 2026	Data breach investigation concluded.
July 14, 2026	Case & Associates Properties began notifying affected individuals.

Who is Case & Associates Properties?

Case & Associates Properties, Inc. is a privately held real estate and property management company founded in 1983 and headquartered in Tulsa, Oklahoma. The company manages more than 30,000 apartment units across Arkansas, Kansas, Mississippi, Missouri, Oklahoma and Texas, with communities in cities such as Tulsa, Oklahoma City, Kansas City, Wichita, Little Rock, Ridgeland, Amarillo, El Paso and Waco. Its operations focus primarily on multifamily housing, while its commercial division manages nearly one million square feet of office, industrial and retail property in the Tulsa area.

What should affected individuals do?

Affected individuals should place free credit freezes with Equifax, Experian and TransUnion, review their credit reports for unfamiliar accounts, and monitor financial and Social Security records for suspicious activity. They should also keep the breach notice, remain alert for phishing attempts, and consider placing a free fraud alert. If identity theft or misuse is detected, report it promptly through IdentityTheft.gov and follow its recovery plan. The FTC particularly recommends a credit freeze when a Social Security number has been exposed. The company established a dedicated response line at 877-423-1636, available Monday through Friday from 8:00 a.m. to 5:00 p.m. Central Time, excluding holidays.

Case & Associates Properties Data Breach Notice

The notice describes the Case & Associates Properties data breach, including the type of information that may have been involved and the steps offered to affected individuals.

Open the Case & Associates Properties Data Breach Notice in a New Tab

Sources and additional information about the data breach:

• • Case & Associates Properties Website
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the Case & Associates Properties data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the Case & Associates Properties data breach, Case & Associates Properties data breach notice, Case & Associates Properties class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by Case & Associates Properties or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.