Lumara Bio USA, Inc., a division of ITM, has told current and former employees that a cyberattack on its German parent company’s systems may have exposed their personal information. This page summarizes what the company’s notice letter reports so far.
Lumara Bio USA, Inc.’s Data Breach Investigation
Lumara Bio USA, Inc. is a division of ITM, according to its Notice of Data Breach, which was filed with the Massachusetts state government as part of that state’s public breach notification process. The letter is dated October 26, 2026 and was written on behalf of Lumara Bio USA to inform people about a recent cybersecurity incident affecting the information technology of ITM, its parent company. The incident may have involved personal information relating to Lumara Bio employees.
According to the letter, ITM SE, the Germany-based parent company of Lumara Bio USA, became aware of a cyber-attack affecting certain ITM information technology systems on September 12, 2026. It says ITM promptly took the affected systems offline, engaged external cybersecurity experts and started an investigation into the nature and scope of the incident, including its possible effect on Lumara Bio USA employees.
The ongoing forensic investigation identified unauthorized access to certain ITM systems that contain personal information relating to current and former Lumara Bio USA employees. The company says the affected systems contain personnel records. Because the investigation is still continuing, the letter explains that people are being notified now so they can take precautions while the work goes on, and the picture may change as more is learned. For former employees in particular, the notice is a reminder that records can remain in a company’s systems long after a person has left a job, which is why people who left the company years ago may still receive a letter.
The personal information potentially involved may include names, addresses, dates of birth, Social Security numbers, driver’s license numbers or other government identification information, salary and compensation information, and other employment-related information. The letter cautions that not all categories of information were necessarily involved for every individual. It also says the company has not identified evidence that anyone’s information has been improperly used, but it is notifying people out of an abundance of caution.
Personnel files are among the most sensitive records an employer keeps, because they combine identity details with information about a person’s job and pay. A Social Security number and date of birth can be used to open credit accounts or file fraudulent tax returns. Government identification details can be used to pass identity checks. Salary and compensation figures give criminals material for convincing scams, such as messages that appear to come from human resources or payroll and ask for banking information.
The letter specifically warns people to take care when submitting tax returns, to watch for fraudulent filings made on their behalf, and to be cautious with unexpected emails, calls, links, attachments or payment requests, even when they contain accurate personal or employment-related details. It adds that accurate details are not proof that a message is legitimate. It also reminds recipients never to share passwords, PIN or TAN details or other authentication information.
Lumara Bio USA is offering a complimentary 24-month membership in Experian IdentityWorks, which provides credit monitoring and identity theft protection, including fully managed identity theft recovery services if needed. According to the letter, people must enroll by January 29, 2027 to accept the offer. Anyone who receives the letter should keep it, since it holds the enrollment information that is needed to sign up.
One feature of this incident is that the affected systems belonged to a parent company located in another country, while the people notified are employees of a U.S. division. That arrangement can make it harder for employees to know where their information is stored and who is responsible for protecting it. Attorneys are looking into whether Lumara Bio USA and ITM used reasonable safeguards for the personnel records they held, and whether notice was provided promptly. If you received a Notice of Data Breach from Lumara Bio USA, you may have legal options.
When Did This Breach Occur?
ITM SE, the parent company of Lumara Bio USA, says it became aware of a cyber-attack affecting certain ITM information technology systems on September 12, 2026. The Notice of Data Breach sent to affected current and former employees is dated October 26, 2026, and the company says its investigation is continuing.
What Information Was Breached?
According to the notice, the information potentially involved may include names, addresses, dates of birth, Social Security numbers, driver’s license numbers or other government identification information, salary and compensation information, and other employment-related information.
Not all categories of information were necessarily involved for every individual, so the details in your own letter are the best guide to what applies to you. The company says it has not identified evidence of improper use.
What You Can Do
If you received a notice related to Lumara Bio USA, Inc. or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24-month Experian IdentityWorks membership offered in the letter before the deadline of January 29, 2027, and take extra care when filing your tax return.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Lumara Bio USA, Inc.
Attorneys are reviewing whether Lumara Bio USA and ITM took reasonable steps to protect the personnel records they held, and whether they notified employees promptly. If you are a current or former Lumara Bio USA employee and received a Notice of Data Breach, you may be able to join a class action. Keep your letter and note the date you received it.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
