Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible States Industries data breach. According to dark web monitoring sources, a hacker group calling itself Storm claimed responsibility for a cyberattack on States Industries in a post first observed in October 2026, alleging it had gained access to internal company systems. As of this writing, States Industries has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About States Industries
States Industries LLC is a privately held American manufacturer of hardwood and softwood veneer products, including hardwood plywood, custom wood veneer panels, prefinished panels, and specialty components. Founded in 1966 in Eugene, Oregon, the company produces natural wood veneered panels for residential wall paneling, cabinets, furniture, store fixtures, and architectural interiors, serving customers through retail stores, wholesale distributors, and direct sales to large wood product manufacturers across the US and Canada. The company also operates DrawerBox Specialties in Orange, California, and employs between 201 and 500 people. States Industries previously filed for Chapter 11 bankruptcy in 2010 and was subsequently acquired by Renwood Opportunities Fund for nearly $20 million.
What Happened?
States Industries was listed as a claimed victim on the Storm ransomware group’s dark web leak site, as reported by Ransomware.live. The claim was first observed on October 3rd, 2026, with an estimated attack date of October 2nd, 2026. These are attacker-side allegations only. No public confirmation from States Industries, the Oregon Attorney General, or any independent news source has been found. No specific data types were identified as compromised in any source.
Storm is an emerging Ransomware-as-a-Service operation first indexed on August 7th, 2026. Researchers at Proven Data report that the group had claimed 61 victim organizations across five countries as of late September 2026, and that there is documented evidence of victim inflation — meaning Storm has been known to post unverified claims and duplicate entries to fabricate the appearance of greater operational scale. This warrants additional caution in treating the allegation against States Industries as reliable. Technical analysis tracked under the designation Storm-1175 links the group to exploitation of CVE-2026-18577 in N-able N-central remote monitoring and management infrastructure, with an attack lifecycle that researchers say can complete in under 24 hours. Storm operates a Tor-hosted leak site and uses double extortion tactics.
Key Facts at a Glance
- Company or Organization: States Industries LLC
- Industry: Manufacturing — Veneer, Plywood, and Engineered Wood Product Manufacturing
- Location: 29545 E Enid Rd, Eugene, OR 97402, United States
- Incident type: Ransomware claim (unverified dark web allegation)
- Date of breach: October 2nd, 2026 (estimated, per attacker claim)
- Claim first observed: October 3rd, 2026
- Source: Ransomware.live — States Industries victim page, Proven Data — Storm Ransomware Threat Analysis, Femtosec — Storm Ransomware Targets Exposed RMM Infrastructure, D&B — States Industries LLC Company Profile
What Should You Do?
Even though this incident has not been confirmed by States Industries, it is a good time to take precautions. Consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for anyone to open new accounts in your name. Monitor your existing financial accounts and credit reports closely for unfamiliar activity, and request your free annual credit reports at AnnualCreditReport.com. If you believe your information has been misused, you can report it and get a personalized recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
