Merrill Steel, a structural steel fabrication company based in Schofield, Wisconsin, has been linked to a data breach reported to affect 4,118 individuals in the United States. The incident was disclosed to the Indiana Attorney General on October 27, 2026, and a ransomware group has publicly claimed responsibility.
Merrill Steel’s Data Breach Investigation
Merrill Steel is a structural steel fabricator headquartered in Schofield, Wisconsin. Public information about the incident is limited and comes mostly from a regulatory disclosure and a ransomware group’s own posting, not from a detailed notice by the company. What is known is that the breach was reported to the Indiana Attorney General on October 27, 2026, and that data breach trackers list 4,118 individuals in the United States as affected.
The incident first drew public attention on October 7, 2026. On that date, a ransomware group calling itself Payouts King posted a claim about Merrill Steel on a dark web leak site reached through the Tor network. According to published summaries of that posting, the group said it had obtained 1.6 terabytes of data from the company and intended to publish the stolen information within six to seven days if its demands were not met. A claim of this kind comes from the attackers themselves, so it should be read with caution. Attackers sometimes exaggerate what they took, and a posting is not proof of what information was actually involved or whose it was.
Data breach trackers list July 21, 2026 as the date of the breach. Between that date and the dark web posting, more than two months passed. That is not unusual for ransomware incidents. Attackers frequently spend time inside a network before encrypting files or copying data, and they often only go public with a leak site claim after negotiations fail. The tracker listing does not say when Merrill Steel itself first discovered the activity, and the company has not published its own timeline.
The regulatory filing that surfaced the incident does not describe what types of personal information were involved. Reports note that the exposed information may have included common categories such as names, contact details, or other identifiers, but that is general context for incidents of this type and not a statement by Merrill Steel about what was taken. We are not treating any particular data type as confirmed.
Why does a filing with a state attorney general matter? Indiana, like most states, requires organizations to notify the state when a breach affects its residents, and the attorney general publishes summaries of those reports. When a company reports an incident to a regulator, it is generally because it has concluded that personal information of residents was or may have been acquired. The report is often the first public confirmation that an incident touched personal data at all, which is why a regulatory listing can precede any letter that reaches the people affected.
A manufacturing and fabrication business can hold personal information about many kinds of people, including current and former employees, job applicants, and the contacts of customers or vendors. Employee records tend to include sensitive items such as Social Security numbers, bank details for direct deposit, and benefits information, but Merrill Steel has not said that any of that was involved here. If you worked for, applied to, or did business with the company, you may want to watch for a notice from it.
Merrill Steel has not, in the sources we reviewed, described the steps it has taken in response or announced any protective services such as credit monitoring. Because the incident became public through the attackers’ posting and a regulatory listing rather than through a company statement, the picture may change as more is disclosed, including the cause, the data involved, and the final number of people affected. We will update this page as the company or regulators publish more. In the meantime, anyone who believes they may be affected should take the precautions below.
When Did This Breach Occur?
Data breach trackers list the date of the breach as July 21, 2026. The ransomware group’s claim appeared on October 7, 2026, and the incident was reported to the Indiana Attorney General on October 27, 2026.
The sources we reviewed do not show a date on which Merrill Steel began notifying individuals, and they do not state when the company discovered the incident. This page will be updated if those dates are published.
What Information Was Breached?
The specific types of personal information involved have not been disclosed in the public regulatory information we reviewed. Merrill Steel has not published a list of data types, and we are not guessing at one.
If you receive a notice, it should state exactly what categories of information were involved in your case. Treat that letter as the authoritative source for your situation.
What You Can Do
Watch your mail and email for a notice from Merrill Steel. A real notice should explain what happened, what information was involved, and any protective services being offered. Be wary of messages that ask for personal details or payment and claim to be about this incident.
Review your financial accounts and credit reports regularly for anything you do not recognize. You are entitled to a free credit report from each of the three nationwide credit bureaus on a recurring basis through annualcreditreport.com.
Consider placing a fraud alert or a free security freeze on your credit files with Equifax, Experian, and TransUnion, especially if you believe your Social Security number could have been involved.
If you suspect identity theft, report it to the Federal Trade Commission at ftc.gov/idtheft and to local law enforcement, and keep copies of any reports.
File a Data Breach Lawsuit Against Merrill Steel
When a company is the target of a ransomware attack and personal information may have been taken, affected people sometimes have legal options, including joining a class action to seek compensation for the time, risk, and costs the exposure creates. Whether a claim is viable depends on facts that are not yet public in this case, including what data was involved and what safeguards were in place.
Class Action U can connect you with a lawyer who handles data breach cases. Speaking with a lawyer does not commit you to anything.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
