In December 2024, Cornwell Quality Tools experienced a data breach following a ransomware attack by the Cactus group. The company detected unusual activity on December 20, 2024, which stemmed from unauthorized access that began around December 12, 2024. Notifications to affected individuals started on September 4, 2025.
The breach involved 4.6 terabytes of data, including names, Social Security numbers, financial account information, medical/health information, driver's license numbers, dates of birth, and health insurance information. At least 103,782 individuals were potentially affected nationwide, with specific numbers reported for Iowa (616 individuals) and Montana (209 individuals). The exact number of individuals affected in other states remains unclear.
Details about data breaches, including the full scope of personal information compromised and the total number of individuals affected, can emerge over time. Affected individuals were offered 12 months of complimentary credit monitoring and identity theft protection through IDX.