Cornwell Quality Tools Data Breach Lawsuit Investigation
Got a letter from Cornwell Quality Tools about your data? Act fast—Social Security, financial and even medical details for more than 100,000 people may now be in criminal hands. Find out how to protect yourself and see if you can file a claim.
What Happened at Cornwell Quality Tools?
Cornwell Quality Tools—an Ohio-based manufacturer and distributor serving the automotive and aviation sectors—spotted suspicious activity on its network on December 20, 2024. A forensic investigation showed a hacker had already slipped in by December 12 and later exfiltrated files.
The ransomware outfit Cactus took credit for the attack on February 3, 2025, boasting on the dark web that it stole 4.6 terabytes of data. Cornwell completed its review and began mailing notice letters on September 4, 2025.
Whose Information Was Exposed?
- Names and addresses
- Social Security numbers
- Dates of birth & government-issued ID numbers
- Financial account or payment card details
- Protected health information
In total, 103,782 individuals were affected, including 2,236 Massachusetts residents, 973 Mainers, and an undisclosed number in Vermont.
Timeline of Key Events
- Dec 12 2024: Unauthorized access begins.
- Dec 20 2024: Cornwell detects suspicious network activity.
- Feb 3 2025: Cactus group publicly claims responsibility.
- Sept 4 2025: Notice letters mailed to victims.
- Sept 8 2025: Breach reported to MA, ME, and VT Attorneys General.
Your Legal Rights After the Cornwell Quality Tools Data Breach
Data breach laws give victims the right to:
- Receive free credit monitoring: Cornwell is offering IDX services with dark-web monitoring, identity theft insurance (up to $1 million) and recovery support.
- Seek compensation: You may be able to join a class action to recover losses such as unreimbursed fraud charges, time spent resolving issues, and emotional distress.
- Obtain additional security protections: Place a fraud alert or credit freeze to make it harder for criminals to open new lines of credit in your name.
Protect Yourself Now
- Enroll in the complimentary IDX credit-monitoring service right away.
- Check your bank, credit-card and insurance statements weekly for strange activity.
- Request free reports from Equifax, Experian and TransUnion via AnnualCreditReport.com and dispute any errors.
- Stay alert for phishing emails, phone calls or texts posing as Cornwell or your bank.
- Document any out-of-pocket costs—you may need these to support a claim.
Frequently Asked Questions
How do I know if I’m part of the Cornwell Quality Tools data breach?
You should have received an official mailed notice dated September 4, 2025. If your letter references IDX credit-monitoring enrollment, you are affected.
What kinds of data did Cornwell Quality Tools lose?
According to regulatory filings, exposed data may include full names, Social Security numbers, dates of birth, addresses, government ID numbers, financial information, and certain medical details.
Is the Cornwell Quality Tools breach connected to identity theft cases yet?
No public reports directly link this breach to identity-theft incidents, but stolen information is highly valuable on dark-web marketplaces—making proactive monitoring essential.
Does Cornwell Quality Tools offer free credit monitoring?
Yes. The company has partnered with IDX to provide 24-month credit monitoring, a $1 million identity-theft insurance policy, and full restoration services.
Can I join a Cornwell Quality Tools data breach lawsuit?
Potentially. Individuals whose information was compromised may qualify to seek monetary relief through a class action. Preserve all evidence (notice letter, time logs, receipts) and consult legal counsel for eligibility.
What deadlines apply to claims against Cornwell Quality Tools?
Deadlines vary by state, but many consumer-protection statutes impose a two- to four-year window from the date of discovery. Act promptly to avoid missing the statute of limitations.