Merrill Iron & Steel, Inc., operating as Merrill Steel, disclosed a data breach that occurred on July 21, 2026. The incident came to public attention after the company reported the matter to regulatory authorities, including the Indiana Attorney General. A ransomware group known as Payouts King claimed responsibility for the cyberattack and alleged that it obtained 1.6 terabytes of data from the company's network.
The filing with the Indiana Attorney General indicated that 4,118 individuals nationwide were affected by the breach, including five residents of Indiana. Merrill Steel began issuing breach notification letters on October 27, 2026. The regulatory report did not publicly specify the precise categories of personal information exposed during the incident, and the company has not released a confirmed list of compromised data elements.
Additional information about the incident may emerge as investigations continue. Consumer notification letters and regulatory filings can disclose further technical and scope details over time.