Merrill Iron & Steel (United States) notified the Indiana Attorney General of a data breach on 27 October 2026. It affected 4,118 people.
People affected
4,118people
Reported
27 October 2026Official notice
Time to tell
98 daysfrom 21 July 2026 · the median is 147
What was exposed
The register’s list does not say what was exposed; the notice it links to (under Sources) usually does.
Before the notice: the ransomware gang Payoutsking named Merrill Iron & Steel on its leak site on 9 October 2026, 18 days before this was reported. Matched by the organisation’s name: the notice itself does not say who the attacker was.
Merrill Iron & Steel (United States) notified the Indiana Attorney General of a data breach on 27 October 2026. It affected 4,118 people. The sources do not say how it happened.
What data was exposed in the Merrill Iron & Steel breach?
The notices and reports so far do not say what was exposed. This page is updated when they do.
How do I know if I was affected?
Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.
Is there a Merrill Iron & Steel data breach settlement?
No settlement open for claims is on record for Merrill Iron & Steel as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.
Is a letter, email or text about the Merrill Iron & Steel breach real or a scam?
A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Merrill Iron & Steel’s own site, or check the letter here.
Privacy Unpacked