KBRA Statement Regarding the National Association of Insurance Commissioners (NAIC) Cybersecurity Incident 26 Jun 2026  |  New York KBRA is issuing this statement in the interest of transparency to our clients, investors, issuers, and other market participants regarding a cybersecurity incident recently disclosed by the National Association of Insurance Commissioners (NAIC). The facts regarding the incident are set forth in the NAICâs public Security Update, available on the NAICâs website. The situation is evolving, and we encourage all clients to check for updates on the NAICâs website for information on what data has been compromised. The NAIC became aware of a cybersecurity breach affecting its systems on June 11, 2026. On June 18, the NAIC publicly disclosed the incident and subsequently notified KBRA. On June 26, the NAIC notified KBRA that unpublished KBRA ratings information submitted through our regulatory data feed had been exported during the incident. The NAIC requires KBRA and other credit rating agencies to provide these data feeds for NAIC designation purposes. Based on the information provided to KBRA by the NAIC, the compromised data includes unpublished ratings information and related identifiers but did not include transaction or issuer names or information. On June 26, the NAIC informed KBRA that the compromised information involved in the incident had been uploaded to a site used to distribute data obtained through cyber incidents. This incident did not involve unauthorized access to KBRAâs systems or a compromise of KBRAâs cybersecurity controls. Based on the information currently available, unauthorized access occurred within the NAICâs systems after KBRA had securely transmitted information pursuant to regulatory reporting requirements. As a repository for confidential regulatory information submitted by credit rating agencies, the NAIC is responsible for safeguarding that information and for notifying affected organizations when a cybersecurity incident may affect information entrusted