Skip to content
Breach Index · running record

Capital Group (American Funds) data breach history (2016-2026): no confirmed breach, one vendor scare

Capital Group runs the American Funds mutual funds and is one of the largest US fund managers. This page records security incidents tied to it since 2016, what it said, and what investors should do.

Short answer

Was Capital Group hacked?

We found no confirmed breach of Capital Group’s own systems from 2016 to 2026 in the sources we read, and no breach notice naming Capital Group or American Funds.

The one incident close to it was at a vendor. On 5 May 2023 Capital Group Canada said InvestorCOM, a print and delivery supplier, had a cybersecurity incident involving the GoAnywhere file-transfer tool, which notified it on 10 April 2023. Capital Group said “our internal systems have not been compromised”, that it does not use InvestorCOM to deliver investor materials, and that it did not believe Capital Group Canada was affected, while it verified this with InvestorCOM.

Timeline at a glance

  1. 10 Apr 2023InvestorCOM tells Capital Group Canada of an incident involving GoAnywhere. (Capital Group statement)Not a breach
  2. 5 May 2023Capital Group: internal systems not compromised; Canada not believed affected. (Capital Group statement)Not a breach
  3. 2016-2026No Capital Group or American Funds entry in California’s breach list. (California AG)Not a breach

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Capital Group incident timeline, in detail

Confirmed = acknowledged by Capital Group, a regulator filing or a court. Reported = credible reporting Capital Group has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Apr-May 2023Not a breachVendor incident (InvestorCOM / GoAnywhere)

InvestorCOM (GoAnywhere) vendor incident: Capital Group says it was not affected

What happened. InvestorCOM, a print and delivery vendor, had unauthorized access to investor personal information through its GoAnywhere secure file-transfer supplier. InvestorCOM notified Capital Group on 10 April 2023.

Impact. Capital Group said its internal systems were not compromised, it does not provide investor information through InvestorCOM’s services, and based on InvestorCOM’s initial information it did not believe Capital Group Canada was affected. We found no later update.

Sources: Capital Group Canada statement, 5 May 2023

The pattern across the record

A clean public record, with a vendor near-miss

The only incident we found in ten years was at a vendor Capital Group said it did not use for investor data. That is the same file-transfer exposure (GoAnywhere, then MOVEit) that hit many peers in 2023.

Older history

In 2014, before this page’s window, Capital Group asked about 800,000 customers to change passwords after the Heartbleed bug, saying it had no sign accounts were accessed (via search).

What it means for Capital Group investors — and what to do

There is no confirmed Capital Group breach for American Funds investors to act on. The practical risks are the general ones: reused passwords and phishing that uses the brand.

  1. 1.Check any breach letter carefully

    If a letter names Capital Group or American Funds, see which company was actually breached and call the number on Capital Group’s own site.

    Decode a breach notice
  2. 2.Use a unique password and two-step sign-in

    Most account takeovers at fund companies use passwords stolen from other sites.

    Phishing-resistant MFA planner

CISO takeaways

Know your vendors’ file-transfer tools

GoAnywhere and MOVEit breaches in 2023 reached firms through suppliers. Ask vendors what they use and how fast they must tell you.

Vendor Risk Scorecard
Have a third-party breach playbook

Capital Group’s statement is a model of saying what is known and what is still being verified.

Third-party breach checklist

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.InvestorCOM data breach (Capital Group Canada statement) — Capital Group, 5 May 2023
  2. 2.Data security breach search: Capital Group — California AG, 13 Nov 2026
  3. 3.American Funds urges new client passwords over Heartbleed (via search) — InvestmentNews, Apr 2014

Frequently asked questions

Was Capital Group hacked?

We found no confirmed breach of Capital Group’s own systems from 2016 to 2026. In 2023 its vendor InvestorCOM had an incident, and Capital Group said its internal systems were not compromised.

Has American Funds had a data breach?

We found no breach notice naming American Funds or Capital Group from 2016 to 2026. In 2014 Capital Group asked customers to change passwords after Heartbleed, as a precaution.

Was Capital Group affected by the InvestorCOM breach?

Capital Group Canada said in May 2023 that, based on InvestorCOM’s initial information, it did not believe it was affected, and that it does not use InvestorCOM to deliver investor materials.

Is there a Capital Group data breach settlement?

We found no data breach lawsuit or settlement involving Capital Group or American Funds.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Capital Group. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.