Skip to content
Breach Index · running record

Invesco data breach history (2016-2026): what is confirmed, and what is not

Invesco is a large global asset manager. This page records every cybersecurity incident we could tie to it from November 2016 to November 2026, with the source for each line. The short version: the public record is thin, and the one confirmed case happened at a vendor.

Short answer

Was Invesco hacked?

We found no confirmed breach of Invesco’s own systems from 2016 to 2026 in the sources we read. We found no SEC cyber disclosure, US state breach notice or regulator action naming Invesco for a security incident.

One vendor incident is confirmed. In a notice dated 20 December 2024, Invesco Asset Management in Japan said a contractor that stores and ships its printed materials and promotional items, Sogyo Service, was hit by unauthorized access and ransomware in September 2024. Invesco said names, addresses and phone numbers of companies it serves, and the names of contact people there, may have leaked. It said data on investors in its public funds was not involved, and that no actual leak had been confirmed.

Separately, Invesco warns that criminals impersonate it on WhatsApp, social media and fake job ads. That is fraud using its name, not a breach of its systems.

Timeline at a glance

  1. 12-13 Sep 2024Ransomware hits Invesco Japan’s storage and shipping contractor; client company contacts may be exposed. (Invesco Japan notice)Confirmed
  2. 20 Dec 2024Invesco Japan publishes its notice: fund investors’ data not involved; no leak confirmed. (Invesco Japan notice)Confirmed
  3. Dec 2025Invesco fraud alert lists WhatsApp, crypto and fake-job scams using its name. Not a breach. (Invesco)Not a breach

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Invesco incident timeline, in detail

Confirmed = acknowledged by Invesco, a regulator filing or a court. Reported = credible reporting Invesco has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Sep 2024 (disclosed 20 Dec 2024)ConfirmedThird-party / vendor ransomware

Ransomware at a Japanese storage and shipping contractor may have exposed institutional client contacts

What happened. Invesco Asset Management (Japan) said that on 12 September 2024 a server failed at 株式会社倉業サービス (Sogyo Service), the company it pays to store and ship its materials and promotional items. The next day the contractor’s server maintenance firm found unauthorized access and a ransomware attack. The same contractor was named in notices by PIMCO Japan, so the attack touched more than one asset manager.

Impact. Per Invesco’s notice: company names, addresses and phone numbers of firms that receive its investment management services, and the names of contact people there. Invesco said personal data of investors in its public mutual funds was not included. The contractor told Invesco a leak could not be ruled out but no actual leak had been confirmed. Invesco did not give a number of people.

Sources: Invesco Asset Management (Japan) notice, 20 Dec 2024 · PIMCO Japan final report on the same contractor, 25 Nov 2024

2025Not a breachBrand impersonation / fraud

Impersonation scams use the Invesco name

What happened. Invesco’s fraud alert page warns of fake WhatsApp investment groups, “pig butchering” crypto scams, social media investment fraud, business email compromise and fake job postings that use its name.

Impact. No Invesco system or data is described as compromised. The risk is to people who trust a message that looks like Invesco.

Sources: Invesco Global Fraud Alert

The pattern across the record

The exposure sits with small vendors

The only confirmed case is a print-and-shipping contractor in Japan holding client contact lists. Low-profile vendors that handle mailing data rarely get the security attention a custodian or transfer agent does.

One vendor, several asset managers

The same contractor attack appears in PIMCO Japan’s notices. When a shared vendor is hit, several firms disclose the same incident weeks apart.

What it means for Invesco clients — and what to do

Nothing in the public record suggests Invesco fund accounts were exposed. The practical risk for clients is impersonation: messages that look like Invesco and ask for money or details.

  1. 1.Treat unsolicited “Invesco” messages as suspect

    Invesco says it never asks for account or personal details over WhatsApp or other messaging apps. Call the number on Invesco’s official site before acting on any message.

  2. 2.If you got a breach letter, read what it actually says

    Check which company sent it, what data is listed and what is offered. Vendor letters often name the client firm in passing.

    Breach notice decoder
  3. 3.Lock down your investment account sign-in

    Use a unique password and the strongest sign-in option your provider offers; a passkey or security key beats SMS codes.

    Phishing-resistant MFA planner

CISO takeaways

Inventory the “boring” vendors

Mailing, print and promotional-item vendors hold client contact lists. Put them in scope for vendor risk reviews.

Vendor Risk Scorecard
Rehearse a vendor breach

Practise the first 72 hours when a supplier tells you your data was on a ransomed server.

Vendor Breach Lab
Have a third-party breach checklist ready

What to ask the vendor, what to log and when to notify, before the call comes.

Third-party breach checklist

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.弊社業務委託先における不正アクセスおよびランサムウェア攻撃被害について (notice on vendor ransomware) — Invesco Asset Management (Japan), 20 Dec 2024
  2. 2.Final report on the Sogyo Service cyberattack — PIMCO Japan, 25 Nov 2024
  3. 3.Global Fraud Alert — Invesco, 1 Dec 2025

Frequently asked questions

Was Invesco hacked?

We found no confirmed breach of Invesco’s own systems from 2016 to 2026 in the sources we read. In December 2024 Invesco Japan disclosed a ransomware attack on a contractor that stores and ships its materials, which may have exposed contact details of institutional clients.

Was there an Invesco data breach in 2024?

Only at a vendor. Invesco Asset Management (Japan) said its storage and shipping contractor, Sogyo Service, was hit by ransomware in September 2024. Possibly exposed: client company names, addresses, phone numbers and contact names. Invesco said fund investors’ data was not included and no leak had been confirmed.

Were Invesco fund investors affected?

Invesco’s notice says personal data of investors in its public mutual funds in Japan was not part of the data at the contractor. We found no notice affecting US or UK fund investors.

Is there an Invesco data breach settlement?

We found no data breach lawsuit or settlement involving Invesco in the sources we read.

I got a WhatsApp message from “Invesco”. Is it real?

Be careful. Invesco says it never asks for account or personal details through messaging apps and warns of fake investment groups using its name. Contact Invesco through its official website instead.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Franklin Templeton data breachFinancial services

2023 InvestorCOM vendor hack, 89,470 clients

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Invesco. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.