New Congol LLC dba New Congoleum (“Congoleum”), a flooring manufacturer based in Mercerville, New Jersey, recently disclosed a cybersecurity incident involving unauthorized access to its network systems. The breach potentially exposed sensitive personal information belonging to current or former individuals associated with the company. Congoleum is now offering complimentary identity protection services through IDX to affected individuals.
New Congoleum’s Data Breach Investigation
According to the company’s notice, Congoleum discovered unusual activity within its network environment on March 24, 2026. Upon detecting the suspicious activity, the company immediately launched an investigation and engaged independent cybersecurity experts to help secure the network and determine the scope of the incident.
The investigation ultimately determined that certain personal information may have been involved in the cybersecurity event. Congoleum later confirmed that approximately 4,831 individuals were affected by the breach, including 6 Maine residents. The company reported the incident as an external system breach (hacking).
While the complete details regarding how the unauthorized actor gained access have not been publicly disclosed, Congoleum stated that it took immediate steps to contain the incident and strengthen the security of its systems. The company also began notifying affected individuals in writing on May 8, 2026.
Data breaches involving Social Security numbers can create long-term risks for affected individuals because cybercriminals may attempt to use stolen information for identity theft, tax fraud, or financial fraud. As a result, companies often provide credit monitoring and identity protection services following these incidents.
Congoleum stated that it is offering affected individuals complimentary identity protection services through IDX, which include credit monitoring, identity theft recovery support, and identity fraud insurance coverage.
When Did This Breach Occur?
The cybersecurity incident occurred on March 24, 2026. The breach was discovered on April 30, 2026.
Affected individuals began receiving written notification letters on May 8, 2026.
What Information Was Breached?
According to the notice provided by Congoleum, the potentially exposed information may have included:
- Names
- Social Security numbers
The company indicated that these data elements may have been involved as part of the unauthorized access incident.
What You Can Do
If you received a notification from Congoleum regarding this breach, there are several important steps you can take to help protect your information:
- Enroll in the complimentary identity protection services offered through IDX before the enrollment deadline of August 8, 2026.
- Monitor your credit reports, financial accounts, and tax filings for suspicious activity.
- Consider placing a fraud alert or security freeze with Equifax, Experian, and TransUnion.
- Review your free annual credit reports through AnnualCreditReport.com.
- Be cautious of phishing emails, phone calls, or text messages asking for personal information.
- Promptly report any suspected fraud or identity theft to your financial institutions and law enforcement authorities.
The complimentary IDX services reportedly include:
- 12 months of credit monitoring
- Identity theft protection services
- A $1 million identity fraud loss reimbursement policy
- Fully managed identity theft recovery services
Even if no fraudulent activity has been detected, stolen personal information may still circulate online or be used later by cybercriminals.
File a Data Breach Lawsuit Against New Congoleum
Individuals affected by the New Congoleum data breach may have legal rights and could qualify to pursue compensation for damages related to the exposure of their personal information. Data breach lawsuits commonly seek compensation for out-of-pocket expenses, time spent addressing fraud concerns, identity theft risks, and loss of privacy.
Companies that collect and store sensitive personal information are expected to maintain reasonable cybersecurity safeguards to protect that data from unauthorized access. When those protections fail, affected individuals may face ongoing risks long after the breach occurs.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
