Cotton Incorporated, the company behind the CottonWorks.com website, has disclosed that a database export holding user registration information was inadvertently made public. This page explains what the company has said, what information may be involved, and what registered users can do.
Cotton Incorporated’s Data Breach Investigation
Cotton Incorporated has notified registered users of its CottonWorks.com website, and filed a sample of its notice with the California Attorney General, after a database export containing user registration information was inadvertently made public. According to the notice, the exposure happened while the company was transitioning the CottonWorks.com website from one hosting provider to another. During that move, a database export holding information that users supplied when they registered for the site became publicly reachable.
The company states that it believes the export was downloaded on four occasions by outside actors during the window between September 18, 2026 and October 15, 2026. It also states that it has not received any evidence that the information in the database has been used by a third party. Those statements come directly from the company’s own notification, and the number of registered accounts contained in the export has not been published in the materials reviewed for this page.
This incident is different from the typical criminal intrusion that dominates breach headlines. No attacker is described as having broken through a firewall or deployed malware. Instead, the notice describes an internal migration problem in which a file that should have stayed private was left accessible. Even so, the legal and practical consequences for the individuals whose information was in the file can be similar, because once a file has been downloaded by someone outside the organization, the original owner cannot control where copies end up or how they are used.
Website migrations are a well-understood source of security gaps. Moving a site between hosting environments often involves exporting databases, copying files between servers, and creating temporary storage locations. If any of those temporary copies is left in a publicly accessible location, or if access controls are not recreated correctly on the new environment, sensitive material can be exposed without any hostile action at all. Organizations that handle personal information are generally expected to put safeguards around exactly these transitional steps, including reviewing what is stored where, restricting access, and confirming that exports are deleted once they are no longer needed.
The notice also raises a concern that goes beyond the exposed profile details. According to the company, the export included the plaintext password that users chose for CottonWorks.com. Storing passwords in readable form, rather than in a hashed and salted format, is widely regarded as a poor security practice, because anyone who obtains the file can read the passwords directly. Many people reuse the same password, or a close variation of it, across several online accounts. A readable password paired with an email address can therefore be tried against email providers, banking sites, shopping accounts and workplace systems in an automated attack known as credential stuffing.
Cotton Incorporated says that after learning of the exposure it disabled access to the database, removed cleartext passwords from the database, and began reviewing its security processes and its arrangements with third-party hosting providers. The company also states that it is notifying users when they visit CottonWorks.com and is requiring them to change their passwords. Those steps may limit further harm going forward, but they cannot undo the fact that copies of the export may already exist outside the company’s control.
Because the export also may have contained employer or school names, physical addresses and biographical details that users entered, the information could be combined to build convincing, personalized phishing messages. A scammer who knows where someone works or studies, and who can quote a real password the person once used, has a strong advantage in persuading that person to click a link, hand over a code, or approve a payment. Anyone who received this notice should treat unexpected messages with extra caution for the foreseeable future.
Filing a sample notice with the California Attorney General is a public-disclosure step California law requires once a notice goes to a large enough group of California residents. That fact alone does not reveal the total number of affected users nationwide, and the notice itself does not provide one. Registered users in other states may have been contacted as well, and the notice includes state-specific consumer protection contact information for several jurisdictions.
Anyone who registered an account on CottonWorks.com and then received a notification from Cotton Incorporated may have claims worth discussing with a lawyer. Questions that matter in a case like this include whether the company took reasonable steps to protect stored information, why passwords were kept in a readable form, and whether the migration was handled with appropriate oversight. Class Action U is monitoring this incident and will continue to update this page as more details become public.
When Did This Breach Occur?
The notice identifies the relevant exposure window as September 18, 2026 through October 15, 2026. During that period, the company believes the database export was downloaded on four occasions by outside actors. The notice does not say exactly when the export first became publicly accessible, when Cotton Incorporated discovered the problem, or when individual letters and emails were sent. The matter was reported to the California Attorney General on November 2, 2026.
Because the notice does not include a discovery date or a mailing date, affected users should not assume that the exposure ended on any particular day beyond what the company has stated. The practical takeaway is that anyone who held a CottonWorks.com account during the period described should assume their registration details could have been viewed and act accordingly.
What Information Was Breached?
According to the notice, the database export contained the information that users provided when they registered with CottonWorks.com. That information may include a user’s name and email address, the name of an employer, college or university, a physical address, biographical information the user entered, and the plaintext password the user chose for the site.
The inclusion of a readable password is the most urgent concern. Anyone who reused that password elsewhere should change it on every other account right away. The company’s notice does not state that Social Security numbers, financial account numbers or payment card details were part of the export, and none are listed among the data types the company identified.
What You Can Do
Cotton Incorporated’s notice recommends that users first change their CottonWorks.com password. If the same password was used on any other website or service, change it there as well and check those accounts for unauthorized activity, then notify the administrator of any service where you find it.
Beyond that, consider using a password manager to create a unique password for every account, turn on multi-factor authentication wherever it is offered, and be skeptical of emails or messages that mention your employer, school or address. Monitor account statements and credit reports, and remember that you are entitled to a free credit report each year from each of the major credit bureaus. If you believe your information has been misused, you can contact the Federal Trade Commission at identitytheft.gov or your state attorney general’s office. You can also place a fraud alert or a security freeze on your credit file at no cost.
File a Data Breach Lawsuit Against Cotton Incorporated
When a company collects personal information and stores it, it takes on a duty to protect it. Where an organization stores passwords in a readable form and then allows a database export to become publicly accessible, affected users may have grounds to pursue a data breach class action seeking compensation for the time, risk and harm that follow. Whether a particular claim is viable depends on the facts, including what information about you was stored and how it has been used since.
If you received a notice from Cotton Incorporated about CottonWorks.com, you may be eligible to participate in a data breach lawsuit. An experienced attorney can review your situation, explain your options, and help you understand the next steps.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
