A ransomware group known as Chaos claims to have stolen 402GB of Glasfloss corporate data, including accounting, contract, and employee ESOP records. The breach affects current and former employees and possibly business partners, though the exact number impacted hasn’t been disclosed. Affected individuals should monitor their credit reports and consider a credit freeze immediately.
| Company | Glasfloss |
|---|---|
| Industry | Manufacturing |
| Data Types Exposed | Contracts and Vendor Agreements, ESOP Records, Accounting and Finance Documentation, Employee Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Glasfloss Data Breach?
Glasfloss, a manufacturing company, has confirmed it was the target of a ransomware attack that led to the theft of internal company files. A group calling itself Chaos has claimed responsibility. The group says it accessed and copied roughly 402 GB of corporate data before publishing notice of the theft online.
According to the disclosed information, the stolen files span several departments. This includes accounting and finance records, along with employee-related documentation. The breach notification connected to this incident became public in September 2026. As a result, affected individuals are only now learning the scope of what may have been taken.
The exact date the intrusion first occurred has not been publicly disclosed. However, ransomware groups like Chaos typically gain access through phishing emails, stolen credentials, or unpatched software before quietly extracting data. Once inside a network, these groups often sit undetected for weeks or months while they map out valuable files.
Glasfloss is now working through the process of confirming exactly what was taken. Because forensic investigations into ransomware intrusions take time, the full extent of the exposure may not be known for some time. In the meantime, the public claim from the Chaos group has already put sensitive company data at risk.
Who was affected?
The individuals affected by this breach likely include current and former Glasfloss employees. Because the leaked files reportedly include ESOP (Employee Stock Ownership Plan) records, this suggests that employees enrolled in company retirement or ownership programs may be impacted. In addition, the accounting and finance documents suggest that vendor or contract partners could also be involved.
At this time, the exact number of people affected has not been publicly disclosed. This means individuals cannot yet confirm their inclusion based on a specific total. Because Glasfloss operates in the United States, the impacted population is expected to be primarily US-based.
It also remains unclear whether the exposed records include information belonging to minors, such as dependents listed on benefits paperwork. Until Glasfloss releases more specific details, affected individuals should assume their information could be part of the exposed dataset if they have any financial or employment relationship with the company.
What Information Was Potentially Exposed?
The claimed leak reportedly touches multiple categories of sensitive business and personal data. Based on the description of the stolen files, the exposure appears to center on financial and employment-related records rather than customer data.
- Contracts and vendor agreements
- ESOP (Employee Stock Ownership Plan) records
- Accounting and finance documentation
- Employee records
Because ESOP records often include personal identifying details tied to compensation and retirement benefits, this raises real concern. For example, these files can sometimes contain Social Security numbers, dates of birth, or bank account details used for distributions. If that level of detail was included in the stolen files, affected employees could face a heightened risk of identity theft.
Meanwhile, the accounting and contract documents could expose banking details, tax identification numbers, or vendor payment information. As a result, both current employees and business partners connected to Glasfloss should treat this incident seriously. Fraudsters often use stolen corporate financial data to attempt wire fraud, fake invoicing scams, or targeted phishing against people named in the leaked files.
What is the company doing?
Glasfloss has acknowledged the incident became public through the ransomware group’s own disclosure. In response, the company is expected to be conducting an internal investigation to determine the true scope of the theft. Typically, this involves working with cybersecurity forensic specialists to trace how the intrusion happened and confirm which files were actually accessed.
Because this event involves a claimed data leak rather than just system disruption, Glasfloss will likely need to notify any individuals whose personal information was confirmed to be part of the stolen files. In addition, companies facing this type of exposure often review their network security, reset credentials, and strengthen monitoring to prevent a repeat incident. At this stage, it has not been publicly disclosed whether Glasfloss is offering credit monitoring or identity protection services to those affected.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone connected to Glasfloss as an employee, former employee, or business partner should begin reviewing their credit reports closely. You can request a free copy from each of the three major credit bureaus once per year through AnnualCreditReport.com. Checking these reports regularly helps you catch new accounts or inquiries you did not authorize.
Because financial and ESOP records may have been included in the stolen data, unusual credit activity could be an early warning sign of misuse. If you notice unfamiliar accounts or hard inquiries, report them to the credit bureau immediately. Acting quickly can limit the damage caused by identity thieves.
Consider a Fraud Alert or Credit Freeze
Given that financial documentation and employee records were reportedly exposed, placing a fraud alert on your credit file is a smart precaution. A fraud alert requires lenders to take extra steps to verify your identity before opening new credit in your name. This can be done for free through any one of the three credit bureaus.
For stronger protection, you may also want to consider a credit freeze. A freeze restricts access to your credit file entirely, making it much harder for someone to open new accounts using your information. Although a freeze takes a bit more effort to lift when you need credit yourself, it offers the highest level of protection against identity theft.
Watch for Phishing and Scam Attempts
Following any data breach, scammers often use stolen information to craft convincing phishing emails or phone calls. Because this breach reportedly involves detailed financial and contract data, criminals may attempt to impersonate Glasfloss, a vendor, or even a benefits administrator. Be cautious of any message asking you to confirm personal details or click a link.
Instead of responding directly, verify the sender through official contact channels you already trust. For example, call the company using a number from its official website rather than one provided in a suspicious email. This simple habit can prevent you from falling victim to a follow-up scam tied to this breach.
Review Retirement and Benefits Accounts
Because ESOP records were reportedly included in the stolen files, employees should log into their retirement or benefits accounts and check for unusual activity. Look for unauthorized changes to beneficiary information, direct deposit details, or account passwords. If anything looks unfamiliar, contact your plan administrator right away.
In addition, consider updating your password and enabling two-factor authentication on any benefits portal you use. This extra layer of security makes it much harder for someone to access your account even if your login details were exposed elsewhere. Taking this step now can prevent a second wave of harm from this incident.
Know Your Legal Options
If you were notified that your information was involved in this breach, you may have legal options available to you. Many affected individuals in similar cases have pursued class action claims against companies that failed to protect their data. Consulting a data breach attorney for a free case evaluation can help you understand whether you qualify for compensation.
Because deadlines for filing claims can vary by state, it’s worth acting sooner rather than later. An attorney can also help you understand what documentation to keep, such as notification letters or evidence of financial harm. This ensures you’re prepared if a class action or settlement becomes available.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.