Ransomware Attack at Cornwell Tools
Cornwell Quality Tools suffered a ransomware attack this past December and is now informing its 103,782 victims details of the hack.
The December 2024 data breach compromised Social Security numbers, medical info, and financial account numbers.
Ransomware group Cactus took credit for the attack in February 2025 and said it stole 4.6 TB of data. To prove its claim, Cactus posted sample images of what it said are documents from Cornwell. They include driver’s license scans, tax documents, and credit applications.
“On December 20, 2024, Cornwell became aware of unusual activity within its computer network and immediately took steps to secure its systems, engaging cybersecurity experts in the process,” said a letter to victims of the incident. According to its investigation, an unknown actor gained access to Cornwell’s network and potentially acquired certain files on or around December 12, 2024. Following a comprehensive review of the affected files, Cornwell determined that certain individuals’ personal information may have been involved in this incident. Cornwell then began working diligently to collect up-to-date mailing addresses in order to provide notification of the incident, which was completed on August 4, 2025.”