---
title: "NCH Corporation network-data incident"
description: "NCH Corporation said an unauthorized actor copied network files during activity between January 21 and February 25, 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/nch-corporation-network-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/nch-corporation-network-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/nch-corporation-network-data-incident-2026/stix.json"
---

# NCH Corporation network-data incident

NCH Corporation said an unauthorized actor copied network files during activity between January 21 and February 25, 2026.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** Corporate network files
- **Operational impact:** Files containing employee and related personal information copied
- **Financial impact:** No incident cost disclosed

## What happened

[NCH Corporation](https://www.nch.com/) said an unauthorized actor copied network files during activity between January 21 and February 25, 2026. [1](#source-1)

## Impact

NCH held information about current and former employees, dependents, beneficiaries and other business contacts. Potential data included identity numbers, financial and payment-card information, and medical or insurance details. [1](#source-1)

## Timeline

### January 21, 2026 — Reported unauthorized activity begins

Reported unauthorized activity begins, according to the published account. [Incident notice](https://oag.ca.gov/system/files/NCH%20-%20California%20Notification.pdf). [1](#source-1)

### February 25, 2026 — Reported unauthorized activity ends

Reported unauthorized activity ends, according to the published account. [Incident notice](https://oag.ca.gov/system/files/NCH%20-%20California%20Notification.pdf). [1](#source-1)

### March 9, 2026 — Possible file theft identified

Possible file theft identified, according to the published account. [Incident notice](https://oag.ca.gov/system/files/NCH%20-%20California%20Notification.pdf). [1](#source-1)

### October 2, 2026 — File review completed

File review completed, according to the published account. [Incident notice](https://oag.ca.gov/system/files/NCH%20-%20California%20Notification.pdf). [1](#source-1)

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

NCH learned of possible theft on March 9, engaged outside investigators, notified law enforcement and completed its file review on October 2. It offered identity protection and enhanced security measures. [1](#source-1)

The notice also refers to monitoring offered in November and December 2025, before its stated 2026 intrusion window. It does not explain that chronology. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/nch-corporation-network-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### NCH Corporation data security notice

official · NCH Corporation

<https://oag.ca.gov/system/files/NCH%20-%20California%20Notification.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   File review completed: 2026-10-02
2. **Resulted In · 100% confidence · current**  
   NCH Corporation network-data incident: NCH Corporation said an unauthorized actor copied network files during activity between January 21 and February 25, 2026.
3. **Occurred At · 100% confidence · current**  
   Reported unauthorized activity ends: 2026-02-25
4. **Affected Organization · 100% confidence · current**  
   NCH Corporation network-data incident: NCH Corporation
5. **Discovered At · 100% confidence · current**  
   NCH Corporation network-data incident: 2026-03-09
6. **Resulted In · 100% confidence · current**  
   NCH Corporation network-data incident: Reported unauthorized activity ends
7. **Occurred At · 100% confidence · current**  
   Reported unauthorized activity begins: 2026-01-21
8. **Resulted In · 100% confidence · current**  
   NCH Corporation network-data incident: Possible file theft identified
9. **Occurred At · 100% confidence · current**  
   Possible file theft identified: 2026-03-09
10. **Resulted In · 100% confidence · current**  
   NCH Corporation network-data incident: NCH learned of possible theft on March 9, engaged outside investigators, notified law enforcement and completed its file review on October 2. It offered identity protection and enhanced security measures.
11. **Resulted In · 100% confidence · current**  
   NCH Corporation network-data incident: The notice also refers to monitoring offered in November and December 2025, before its stated 2026 intrusion window. It does not explain that chronology.
12. **Resulted In · 100% confidence · current**  
   NCH Corporation network-data incident: File review completed
13. **Resulted In · 100% confidence · current**  
   NCH Corporation network-data incident: Reported unauthorized activity begins
14. **Resulted In · 100% confidence · current**  
   NCH Corporation network-data incident: NCH held information about current and former employees, dependents, beneficiaries and other business contacts. Potential data included identity numbers, financial and payment-card information, and medical or insurance details.

</details>