Challenge Mfg. Company, LLC has notified individuals of a cybersecurity incident involving unauthorized access to its computer environment that may have exposed sensitive personal information. The company reports that it took immediate steps to investigate and is offering affected individuals complimentary identity protection services, including credit monitoring, insurance reimbursement, and identity restoration services.
Challenge Mfg. Company’s Data Breach Investigation
Challenge Mfg. Company, a supplier of complex assemblies and engineering metal formed products to the automotive industry headquartered in Grand Rapids, Michigan, reported unauthorized activity within its computer systems on May 8, 2026. Upon discovery, the company promptly engaged third-party cybersecurity experts to investigate and contain the incident.
By May 21, 2026, the investigation confirmed that certain files were acquired without authorization. A comprehensive review of these files identified that personal information of at least one New Hampshire resident was involved, including the individual’s name and Social Security number. Challenge then coordinated to notify affected individuals and began offering identity protection services.
As part of the company’s response, the Federal Bureau of Investigation (FBI) was notified, and Challenge committed to cooperating with law enforcement to hold the perpetrators accountable. The company also strengthened network security protocols to prevent similar incidents in the future.
Challenge arranged for affected individuals to receive complimentary identity protection services through IDX, including 12 months of credit monitoring, dark web monitoring, a $1,000,000 identity fraud loss reimbursement policy, and fully managed identity theft recovery services. Enrollment for these services is available online or via QR code using an assigned enrollment code, with a deadline for registration by September 1, 2026.
When Did This Breach Occur?
The cybersecurity incident at Challenge Mfg. Company was first discovered on May 8, 2026. Unauthorized access occurred before this date, and the company confirmed acquisition of files without authorization by May 21, 2026. Affected individuals were notified starting June 1, 2026, once verification of personal data and mailing addresses was completed.
What Information Was Breached?
Based on the company’s investigation, the breach involved the following personal information for at least one New Hampshire resident:
- Name
- Social Security number
Challenge has not publicly disclosed additional categories of data for other individuals, but the affected resident received notice and enrollment instructions for credit monitoring and identity protection services.
What You Can Do
Individuals affected by the Challenge Mfg. Company breach should immediately take steps to protect their personal information:
- Enroll in Identity Protection Services: Use the IDX enrollment portal or QR code provided in the notification to register for 12 months of credit monitoring and identity restoration services.
- Review Credit Reports: Obtain a free credit report annually from each of the three major credit bureaus—Equifax, Experian, and TransUnion—through AnnualCreditReport.com.
- Place Fraud Alerts or Credit Freezes: Consider placing a fraud alert to notify creditors or a security freeze to restrict access to your credit file. Contact each credit bureau directly to implement these protections.
- Monitor Financial Activity: Regularly check bank accounts, insurance statements, and credit reports for unfamiliar or suspicious activity.
- Report Suspected Fraud: File a report with local law enforcement, your state Attorney General, or the Federal Trade Commission at www.ftc.gov/idtheft if you notice suspicious activity.
Following these steps can help mitigate the risk of identity theft and fraudulent activity related to the breach.
File a Data Breach Lawsuit Against Challenge Mfg. Company
Organizations that collect and store personal information have a duty to implement reasonable safeguards. When unauthorized access occurs, affected individuals may have legal options to recover compensation for damages, including loss of privacy, time spent addressing the breach, and out-of-pocket expenses.
Even in cases involving a small number of individuals, joining together with others affected can help hold companies accountable for protecting sensitive personal data and ensure proper measures are implemented to prevent future incidents.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
