Ransomware.live listed Veritiv as a victim associated with the IAH6477 group. The raw listing gives an attack timestamp of September 15, 2026, and describes the reported data volume as 1.9 TiB. The report does not provide an official statement from Veritiv or a regulator confirmation.
The number of affected individuals and the types of information involved have not been disclosed in the consulted material. The material also does not identify affected states, consumer notifications, regulator filings, or confirmed litigation. Further details may emerge if Veritiv or a government agency later issues an incident notice.