Kurt J. Lesker Company (KJLC), a Pennsylvania-based manufacturer and distributor of vacuum technology products serving the semiconductor, electronics, and research industries, notified affected individuals of a data event involving their personal information. Companies that maintain sensitive records on behalf of employees, customers, and partners carry a responsibility to protect that information, and when an incident like this occurs, those affected deserve a clear explanation of what happened and what they can do next.
Kurt J. Lesker Company’s Data Breach Investigation
Public reporting from security researchers indicates that a ransomware group known as Chaos listed Kurt J. Lesker Company on its public leak site around December 2, 2025, claiming to have exfiltrated approximately 615 gigabytes of internal company data. Reporting on the incident has generally described the exposed material as internal files, including engineering, manufacturing, and business records, and has noted that no customer database or payment card information had been explicitly confirmed as compromised in the group’s public posts at the time.
KJLC has since sent formal notification letters to individuals whose personal information was determined to be involved, dated September 11, 2026. Due to requirements imposed by Massachusetts law, KJLC’s letter states that it is unable to provide further details about the nature of the event, which is a common limitation in breach notification letters governed by state disclosure rules.
Manufacturing and technology suppliers like KJLC are increasingly targeted by ransomware groups because their systems can contain not only sensitive personnel and customer records but also valuable engineering and technical data that can be leveraged for extortion. An extended gap between when a ransomware group claims an attack and when formal individual notifications are mailed is not unusual, since companies typically need time to complete a forensic review, determine exactly which individuals’ data was involved, and satisfy varying state notification law requirements before mailing letters.
KJLC is offering affected individuals complimentary credit monitoring services through Cyberscout, a TransUnion company, for 24 months as a precaution. The company has also stated it is reviewing its internal policies and procedures following this event.
Individuals who receive a notification letter from KJLC are encouraged to enroll in the offered monitoring services promptly and to remain alert to phishing attempts referencing this breach, since scammers frequently use news of a data breach to make follow-up scams appear more credible. Reviewing account statements, monitoring credit reports, and considering a credit freeze are reasonable precautionary steps even where the full scope of exposed data has not been publicly detailed.
When Did This Breach Occur?
According to public reporting from security researchers, the underlying ransomware incident was first observed on the Chaos group’s leak site on approximately December 2, 2025. KJLC’s formal notification letters to affected individuals are dated September 11, 2026.
What Information Was Breached?
KJLC’s notification letter does not specify the exact categories of personal information involved, citing restrictions under Massachusetts law. Public reporting on the underlying incident has generally described the ransomware group’s claimed exfiltration as involving internal company files, including engineering and manufacturing records, though the specific personal information categories affecting the individuals notified have not been separately disclosed.
What You Can Do
KJLC is offering affected individuals 24 months of complimentary credit monitoring services through Cyberscout, a TransUnion company. Consider taking the following steps:
- Enroll in the complimentary credit monitoring services offered in your notification letter using the unique code provided.
- Regularly review your financial account statements and credit reports for unfamiliar activity.
- Consider placing a fraud alert or credit freeze with the three major credit bureaus.
- Be cautious of unsolicited calls, texts, or emails referencing this breach, which may be phishing attempts.
File a Data Breach Lawsuit Against Kurt J. Lesker Company
If you received a notification letter from Kurt J. Lesker Company or believe your information may have been involved in this event, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
