Service Provider

March 23, 2026

Norwood, Massachusetts-based fire protection safety provider, Carlysle Engineering, Inc., suffered a ransomware attack in March where personally identifiable information from employees ended up exfiltrated.
“We have discovered that Carlysle Engineering, Inc. was the victim of a ransomware attack,” the company said in a notice to victims. “The attack affected our human resources data, and some of that data may have included some of the personal information we maintain about you as a current or former Carlysle employee or named beneficiary of a current or former Carlysle employee.”
On March 23, 2026, Carlysle discovered a threat actor launched an attack on Carlysle’s primary file server, which encrypted the files on the server. Upon discovery of the attack, Carlysle’s information technology administrator immediately engaged OCD Tech, LLC, a well-known cybersecurity recovery and investigation firm, and cybersecurity legal counsel to investigate the incident and coordinate efforts with our IT administrator.

July 10, 2024

Lincoln, Nebraska-based service provider, Universal Pure, LLC, suffered a cyberattack in July of 2024, discovered it in August of 2025, and is now letting victims know their personally identifiable information ended up stolen in the hack.
“On August 20, 2024, Universal Pure identified suspicious activity within certain computer systems,” the company said in a notice to victims. “Universal Pure quickly took steps to secure its network and launched an investigation into the nature and scope of the activity.”
Through this investigation, Universal Pure determined that certain computer systems were subject to unauthorized access and files ended up taken from the Universal Pure network on separate occasions between July 10, 2024 and August 20, 2024.

November 12, 2025

Moorestown, New Jersey-based manufacturing industry distributor, Shingle & Gibb Automation, LLC suffered a cyberattack in November and is now letting victims know their personally identifiable information ended up stolen in the hack.
“On November 12, 2025, we detected suspicious activity within Shingle’s computer network,” the company said in a notice to victims of the attack. “Upon discovering the incident, we promptly began an internal investigation and worked to secure our network.”
Additionally, Shingle also hired a forensic security firm to assist with its investigation and ensure the security of its network. As a result of the forensic investigation, Shingle determined an unauthorized third party accessed our network, and may have acquired certain files from those systems on November 12.

April 7, 2025

Pasadena, Texas-based heavy industry maintenance and service provider, TIMEC Oil & Gas, Inc., suffered a cyberattack last April and is now letting victims know their personally identifiable information ended up stolen in the hack.
“On or around April 8, 2025, TIMEC became aware of unauthorized activity relating to an employee’s email account,” the company said in a letter to victims of the attack. “Upon becoming aware of this activity, TIMEC promptly launched an investigation to understand the nature and scope of this event.”
As a result of the investigation, the company learned an unknown actor gained access to a TIMEC email account and may have accessed or copied certain emails or attachments within the account between April 7, 2025, and April 10, 2025.

December 25, 2025

Walnut, California-based industrial refrigeration contractor Alliance Industrial Refrigeration Services, Inc. suffered a cyberattack in December and is now letting victims know their personally identifiable information ended up stolen by threat actors.
“On December 25, 2025, we discovered suspicious activity within our network environment,” the company said in a notice to the victims of the attack. “Upon discovery, we took immediate action to secure our network environment and engaged cybersecurity specialists to investigate.’
During the investigation, the company discovered some data from its network ended up accessed and acquired by an unauthorized actor between December 25 and December 26.

September 30, 2025

Port Lavaca, Texas-based critical infrastructure services provider, Palacios Marine & Industrial Coatings, Inc. (PMI), suffered a cyberattack last September and is now letting victims know their personally identifiable information ended up stolen in the hack.
“On September 30, 2025, PMI detected irregular activity within its computer network,” the company said in a notice to victims. “In response, PMI immediately took steps to secure its network and launched an investigation to determine the nature and scope of the activity.”
Upon discovering the event, PMI moved quickly to investigate and respond to the incident, assess the security of PMI systems, and identify potentially affected individuals.

December 22, 2025

San Francisco, California-based cybersecurity provider HackerOne Inc. fell victim to an attack on one of its benefits administrators where the company suffered from a hack where a threat actor stole personally identifiable information from HackerOne’s employees.
HackerOne said it received notification via mail its benefits administrators, Navia, suffered an attack in December where the personal information ended up stolen. HackerOne met with Navia on March 13 to understand what data ended up impacted and the nature of the security incident.
“A Broken Object Level Authorization (BOLA) vulnerability led to an unknown actor accessing Navia data between December 22, 2025 and January 15, 2026,” HackerOne said in a notice to victims. “On January 23, 2026, Navia became aware of suspicious activity in their environment. Navia sent letters dated February 20, 2026 to impacted companies.”

November 25, 2025

Mortgage Educators and Compliance (MEC), a website owned and operated by Austin, Texas-based training provider, 360training.com, Inc. suffered a cyberattack in November where personally identifiable information ended up stolen in the hack.
“On or around November 25, 2025, MEC discovered suspicious activity related to our website,” the company said in a letter to victims. “Upon discovery, we took immediate action to secure our website and started the investigation.”
On November 26, the company’s investigation found an unauthorized party added a script on our site, sending credit card data to a Google Analytics account controlled by an unauthorized party.

September 11, 2025

Trevose, Pennsylvania-based government solution and security provider, Data Systems Analysts (DSA) Inc. suffered a cyberattack in September where personally identifiable information ended up stolen in the hack.
“DSA detected a compromise of its network environment by an unauthorized third party on or about September 11, 2025,” the company said in a letter to victims. “As soon as we became aware of the activity, we took immediate steps to secure the environment and engaged third-party forensic experts to assist in investigating what happened and what information may have been impacted.”
The outside investigators confirmed the environment was secure and hardened. They were also able to enhanced network security, and they conducted a digital forensic investigation to determine the extent of unauthorized activity.