ProAmpac Holdings Inc. has reported a data security incident to the New Hampshire Attorney General. The company says a social engineering attack that impersonated its IT Help Desk led to unauthorized access to its systems and to certain personnel records. Companies that hold employee and payment information are responsible for protecting it.
ProAmpac’s Data Breach Investigation
ProAmpac Holdings Inc., which its notice calls ProAmpac, reported the incident to the New Hampshire Attorney General in a letter dated October 16, 2026, sent by the law firm Polsinelli on its behalf. The letter was filed under New Hampshire’s data breach notification law and concerns the personal information of one New Hampshire resident. A sample of the notice sent to affected people was attached.
According to the filing, ProAmpac discovered the incident on June 22, 2026. It involved social engineering in which someone impersonated the company’s IT Help Desk, and it resulted in the temporary compromise of a single employee account. Social engineering means tricking a person rather than breaking through technical defenses, and help desk impersonation is a well-known way to get an employee to hand over access.
ProAmpac says it immediately activated its incident response protocols, secured the affected account, notified law enforcement and hired outside cybersecurity experts to investigate. The forensic investigation concluded that an unauthorized third party gained access to the company’s computer systems between May 26, 2026 and June 22, 2026, and that during that time it accessed and acquired certain files. That is a window of nearly four weeks.
After the investigation, ProAmpac conducted an in-depth review of the affected files to find out whether they contained personal information. On August 10, 2026, it determined that the files contained the name and payment card information of one New Hampshire resident. The notice to individuals says the records involved were certain personnel records kept on the company’s network.
The company states that its core HR and payroll systems, which it identifies as UKG and ADP, were not affected. That distinction is useful, because it suggests the files at issue were stored outside those systems rather than in the main HR platforms. The filing does not describe what kind of personnel records they were or why payment card information was among them.
The filing reports one New Hampshire resident. That is only the New Hampshire count. It does not give a total across all states, and this page does not estimate a figure. The letter to affected people uses merge fields for the specific data elements, so each person’s letter states which of their own details were involved.
ProAmpac says it strengthened its security by disabling the compromised account, resetting its password and multifactor authentication, clearing active sessions and revoking authentication tokens. It also retained a third party to monitor online forums and marketplaces for any information relating to the event. The filing does not mention credit monitoring being offered, and it says the company is not aware of any reports of fraud or identity theft resulting from the incident.
The time between the discovery on June 22, 2026 and the review result on August 10, 2026 shows how long it can take to learn whose information was in a set of stolen files. The notice to the Attorney General is dated October 16, 2026. Anyone who is told their information was involved should treat the notice as the start of a period of vigilance rather than the end of the matter.
The intrusion began with a single employee account, which shows how one compromised login can open the door to files well beyond what that person normally handles. Organizations often limit this risk by restricting what any one account can reach and by training staff to verify help desk requests, but the filing does not say what safeguards were in place before the incident.
Name plus payment card information is a combination criminals can use directly. Card numbers can be tested with small purchases and then used for larger fraud, or sold. The most useful step is usually to contact the card issuer, ask whether the card number should be replaced and review recent statements. This is general guidance and not a finding about any particular person’s card.
When Did This Breach Occur?
ProAmpac says it discovered the incident on June 22, 2026, and that an unauthorized third party had access to its systems between May 26, 2026 and June 22, 2026. It determined on August 10, 2026 that the affected files contained personal information. Its notice to the New Hampshire Attorney General is dated October 16, 2026.
What Information Was Breached?
According to the filing, the files contained the name and payment card information of the New Hampshire resident it reported.
The notice to individuals states that it concerns certain personnel records, and that each letter lists the specific information involved for that person.
What You Can Do
If you received a notice related to ProAmpac or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Contact the bank that issued your payment card, ask whether it should be replaced, and review recent statements for charges you do not recognize.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against ProAmpac
If you were notified that your payment card information or other personal information was exposed in the incident involving ProAmpac, you may have legal options. Employers and other organizations are expected to safeguard this information, and a class action can help hold them accountable when they fall short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
