Summary
- Environment: Corporate network files
- Operational impact: Files containing employee and related personal information copied
- Financial impact: No incident cost disclosed
- Record status: Developing record. Reviewed November 4, 2026; updated as evidence emerges.
What happened
NCH Corporation said an unauthorized actor copied network files during activity between January 21 and February 25, 2026. [1]
Impact
NCH held information about current and former employees, dependents, beneficiaries and other business contacts. Potential data included identity numbers, financial and payment-card information, and medical or insurance details. [1]
Timeline
Reported unauthorized activity begins
Reported unauthorized activity begins, according to the published account. Incident notice.
[1]Reported unauthorized activity ends
Reported unauthorized activity ends, according to the published account. Incident notice.
[1]Possible file theft identified
Possible file theft identified, according to the published account. Incident notice.
[1]File review completed
File review completed, according to the published account. Incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 4, 2026.
Threat Group & Attack Vector
The reviewed notice does not establish the initial access method.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
NCH learned of possible theft on March 9, engaged outside investigators, notified law enforcement and completed its file review on October 2. It offered identity protection and enhanced security measures. [1]
The notice also refers to monitoring offered in November and December 2025, before its stated 2026 intrusion window. It does not explain that chronology. [1]