International Code Council Data Breach Lawsuit Investigation
Received an August 2026 breach notice from International Code Council?
Dapeer Law, P.A. is investigating a potential class action against International Code Council, Inc., the Washington, D.C. based nonprofit that develops model building codes and standards, on behalf of customers whose payment card information may have been exposed during a June and July 2026 security incident affecting the organization's website.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from International Code Council dated August 2026.
- Your letter offered enrollment in 12 months of complimentary IDX identity-protection services, with an enrollment code and a November 18, 2026 deadline.
- You entered payment card information when placing a purchase on the International Code Council website between June 30 and July 3, 2026.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
International Code Council, Inc. ("International Code Council" or "ICC") reported a security incident affecting its website that made it possible for an unauthorized third party to collect payment card information customers entered when placing purchases online. According to the notice, the unauthorized collection took place between June 30 and July 3, 2026. The notice does not state when the organization discovered the issue or how the website was compromised.
The organization says it secured the affected website functionality, notified impacted consumers, and reported the incident to state authorities. Notice letters were mailed on August 18, 2026, and the incident was reported to the Massachusetts Attorney General, whose filing lists 8 affected individuals, all Massachusetts residents. Impacted consumers were offered 12 months of complimentary identity-protection services through IDX, using an enrollment code provided in the letter, with a November 18, 2026 enrollment deadline.
Payment card data taken directly from a checkout page carries an immediate fraud risk, because the card number, expiration date, and security code are usable together without any further information about the cardholder. Incidents of this type typically involve unauthorized code inserted into a website's payment pages, and whether the International Code Council's website security, payment-page monitoring, and vendor oversight met applicable standards is among the issues being evaluated. The public notice does not itemize which card fields were involved, so notice recipients should review their individual letters.
What to do if you received a letter
Keep your notice letter
Do not discard it. Your letter contains the enrollment code for the complimentary IDX identity-protection services and is important evidence if you decide to participate in a lawsuit.
Enroll in the free 12-month IDX identity protection
Enroll in the IDX identity-protection services offered in your letter before the November 18, 2026 deadline, using the enrollment code printed on your notice. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. Because this incident involved payment card data entered at checkout, review your credit-card and bank statements line by line for the period beginning June 30, 2026, report any unauthorized charge to your card issuer promptly, and ask your issuer about replacing the card used on the ICC website.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, unauthorized card charges, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring the International Code Council to implement stronger website and payment-page security practices going forward, including monitoring for unauthorized scripts on checkout pages and closer oversight of the vendors that support online payments.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from International Code Council. What should I do? +
Keep your letter, then enroll in the complimentary 12-month IDX identity-protection services before the November 18, 2026 deadline using the code printed on the notice. Review your credit-card and bank statements for unauthorized charges going back to June 30, 2026, and report anything unfamiliar to your card issuer right away. Ask your issuer about replacing the card you used on the ICC website, request your free credit reports at AnnualCreditReport.com, and consider placing a fraud alert or security freeze with Equifax, Experian, or TransUnion. Then contact a data breach attorney for a free consultation.
Am I eligible to join a class action against International Code Council? +
If you received the August 18, 2026 International Code Council notice, or can document fraudulent charges linked to a card you used on the organization's website during the incident window, you are likely eligible for a free case evaluation. Eligibility depends on your state of residence, the information involved, and any losses you have suffered. Dapeer Law will review your notice at no cost.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
The notice states that the incident involved "the payment card information you entered when placing a purchase on our website" between June 30 and July 3, 2026. The public filing does not break out which specific card fields were involved, and it does not indicate that Social Security numbers were affected. Your individual letter should describe the information involved in your case.
Did International Code Council offer free credit monitoring? +
Yes. Impacted consumers were offered 12 months of complimentary identity-protection services through IDX at no charge, using an enrollment code provided in the notice letter. The stated enrollment deadline is November 18, 2026. Enrolling does not waive your right to pursue legal claims.
How many people were affected by the International Code Council breach? +
The Massachusetts Attorney General filing reports 8 affected individuals, all Massachusetts residents. The International Code Council has not publicly disclosed a nationwide total, and filings in other states may report additional individuals. This page will be updated as more information becomes available.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The notice filed with the Massachusetts Attorney General is publicly available as a PDF and is linked in the Sources section below. If you received a letter but no longer have it, Dapeer Law can help you obtain a copy during your free consultation.
Sources & references
- Official breach notice filing · Massachusetts Attorney General, The International Code Council, Inc. data breach notice (PDF)
- Company · International Code Council, Inc. (iccsafe.org)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
