2026 NCH Corporation — unauthorised access exposed employee health plan data; SSNs and enrolment details; Vermont and California filings
Data compromised
Name, Social Security number, date of birth and benefits enrolment information, per UpGuard's summary of the notice. Vermont lists 7 residents. A secondary figure of 3,098 affected is unverified.
Technical writeup
First public in May 2026; the October postings were regulator listings, not new disclosures. Maine's AG database was offline when checked. The date conflict is noted above.
Root cause
NCH Corporation notified regulators in May 2026 that unauthorised access between late January and late February 2026 affected its employee group health plan. Sources disagree on when it discovered the incident (March 9 or April 2). An Embargo ransomware claim is unverified.