Almeida Law Group is investigating a data breach at Challenge Mfg. Company, LLC. The breach occurred on May 7th–8th, 2026 and was discovered on May 21st, 2026. If you were affected, contact Almeida Law Group.
About Challenge Mfg. Company, LLC
Challenge Mfg. Company, LLC is an employee-owned (ESOP) Tier 1 automotive supplier established in 1981, headquartered in Grand Rapids, Michigan. The company specializes in metal stamping, welding, and complex metal assemblies for automotive OEMs, operating across 12 U.S. locations with more than 3,000 team members. This breach is significant because it exposed names, Social Security numbers, and medical information — categories of data that can cause serious harm if misused.
What Happened?
Challenge Mfg. Company, LLC was listed in a Texas Attorney General data security breach report (record ID: BR-0005143, published June 26th, 2026). The breach occurred between May 7th, 2026 and May 8th, 2026 and was discovered on May 21st, 2026. A total of 24,211 individuals were affected. Compromised information included names, Social Security numbers, and medical information. Consumers were notified by U.S. Mail.
On May 17th, 2026, the ransomware group Chaos publicly claimed responsibility for a cyberattack against Challenge Manufacturing Company, threatening to expose sensitive data unless contacted within 72 hours. That claim date falls before the May 21st, 2026 discovery date listed in the Texas Attorney General filing, suggesting the company may have become aware of the incident around the time of the threat actor’s public announcement. No prior breaches or class action litigation tied to this specific incident were found as of the research date.
Key Facts at a Glance
- Company or Organization: Challenge Mfg. Company, LLC
- Industry: Automotive manufacturing (Tier 1 automotive supplier)
- Location: Grand Rapids, Michigan
- Incident type: Ransomware attack / unauthorized access
- Date of breach: May 7th, 2026 – May 8th, 2026
- Date breach discovered: May 21st, 2026
- Date of consumer notification: June 26th, 2026 (published at OAG website)
- Total persons affected: 24,211
- Source: Texas Attorney General data security breach report (https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005143); DeXpose ransomware reporting (https://www.dexpose.io/chaos-ransomware-attack-on-challenge-manufacturing-company/)
What Should You Do?
If you received a notice from Challenge Mfg. Company, LLC, take steps now to protect yourself. Enroll in any identity theft protection services the company is offering, if available, and be mindful of any enrollment deadline mentioned in your notice. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Monitor your existing financial accounts and request your free credit reports at AnnualCreditReport.com. Because medical information was involved in this breach, also review any Explanation of Benefits statements from your health insurer and check your medical records for services you did not receive. If you spot anything suspicious, report it at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
