SECURITY INCIDENT NOTICE
Unauthorized Account Intrusion and Account Takeover
October 8, 2026
Mathews IT / CipherOne is issuing this formal security notice regarding a recently discovered cybersecurity incident involving unauthorized access to a third-party service-provider account under our ownership and administration.
What Happened
Mathews IT discovered that an unauthorized party had gained access to one of our telecommunications service-provider/reseller accounts and made significant administrative changes without our knowledge, permission, or authorization.
The activity went beyond an attempted login or simple unauthorized viewing of information.
During the incident, account information was altered, administrative and ownership-related information was changed, legitimate administrative access was removed, and Mathews IT personnel were locked out of an account that had previously been established, maintained, and administered by our company.
Information within the affected account was modified to represent another organization, including replacement contact information and email addresses associated with that organization.
Mathews IT did not authorize these changes.
Based upon the evidence obtained during our investigation, we have identified the apparent source and parties believed to be responsible for the unauthorized activity. Relevant information and evidence have been preserved and provided to law enforcement.
Incident Timeline
All times below are Central Daylight Time (CDT, UTC−5).
Wednesday, October 7, 2026
- 9:10 a.m. — Unauthorized account access and credential activity were detected. Mathews IT / CipherOne began investigating and identified an initial attack vector.
- By 11:48 a.m. — A police report was open with local law enforcement.
- 1:48 p.m. — Further investigation identified the apparent threat actor and the entry vectors associated with the unauthorized activity.
- 3:10 p.m. — Mathews IT / CipherOne regained administrative control of the affected accounts after reporting the incident to law enforcement.
- 5:39 p.m. — Unauthorized activity resumed, and the apparent threat actor regained access. This second intrusion again prevented our team from accessing the affected account. Local law enforcement and the relevant third-party vendors were informed.
Thursday, October 8, 2026
- 9:00 a.m. — Our administrative access was restored, the unauthorized party was locked out, and the identified attack vectors were blocked. The unauthorized activity appeared to have ceased.
- 11:06 a.m. — No further unauthorized activity or use of additional attack vectors had been observed as of this checkpoint.
Mathews IT / CipherOne continues to monitor the affected accounts and investigate the incident. These checkpoints describe what was observed and determined at the stated times; the complete scope and timeline remain subject to the ongoing investigation.
Law-Enforcement Investigation
This incident has been reported to law enforcement and is currently the subject of an active police investigation.
Because that investigation remains ongoing, Mathews IT / CipherOne will not publicly identify the individuals, companies, contractors, consultants, or other parties believed to be involved at this time.
We believe it is important that the investigative process be allowed to proceed based upon technical evidence, account records, authentication information, service-provider records, and other available evidence rather than speculation.
Additional information has been preserved for investigators, and we will continue cooperating with law enforcement as requested.
Our Response
Immediately after discovering the unauthorized account activity, Mathews IT / CipherOne began incident-response procedures.
Actions taken have included securing affected services, reviewing administrative access, preserving available evidence, documenting account changes, reviewing authentication and account activity, communicating with relevant service providers, identifying potentially affected customers, and notifying appropriate parties.
We are also working to preserve records that may help establish precisely how the unauthorized access occurred, when it occurred, what actions were performed, and what systems or information—if any—were viewed or accessed during the incident.
Relevant records may include authentication logs, source IP information, account-change history, administrative-user activity, support records, communication records, security logs, and other forensic information maintained by the involved service providers.
Customer Information
Customers who we believe may have been potentially affected by the incident have been notified.
Based upon our investigation and the evidence available at this time, we have found no evidence indicating that customer data was downloaded, exfiltrated, distributed, sold, or otherwise misused as a result of this incident.
We have also found no evidence at this time demonstrating unauthorized use of customer information obtained through the affected account.
That determination is based on the information currently available and remains subject to the continuing investigation.
Because the affected account itself was unquestionably altered without our authorization, we are treating this matter seriously and continuing to investigate even though there is presently no evidence of customer-data misuse.
Investigation Remains Ongoing
The investigation is not complete.
Mathews IT / CipherOne continues to review additional technical records and is working to determine the complete scope, sequence, and method of the unauthorized activity.
Among the questions being investigated are:
- How unauthorized access to the account was obtained or requested.
- What credentials, representations, or authentication methods were used.
- When the first unauthorized activity occurred.
- Which account settings and administrative records were changed.
- Whether additional parties participated in or facilitated the activity.
- Whether any information was accessed beyond what is currently known.
- Whether additional systems or accounts were targeted.
- The complete timeline of activity before, during, and after the account takeover.
As additional service-provider records, audit information, and investigative findings become available, we expect to obtain a more complete picture of what occurred.
Our Commitment
As an information-technology and cybersecurity provider, Mathews IT / CipherOne understands the level of trust placed in us by our customers.
Unauthorized access to any system or account under our administration is taken seriously.
Our responsibility following an incident is to secure the affected environment, preserve evidence, determine what occurred, communicate honestly with potentially affected customers, cooperate with investigators, and strengthen safeguards wherever appropriate.
That process is underway.
We will continue to provide additional information when material facts are confirmed and when doing so will not interfere with the ongoing law-enforcement investigation.
At this time, there is no evidence that customer information has been misused or otherwise compromised beyond the unauthorized administrative access described in this notice.
The investigation remains active, and additional information will be released as appropriate.
Mathews IT / CipherOne
Security Incident Response
October 8, 2026