Almeida Law Group is investigating a data breach at UFP Technologies Inc. The breach was discovered on September 28th, 2026. If you were affected, contact Almeida Law Group.
About UFP Technologies Inc.
UFP Technologies, Inc. is a publicly traded contract development and manufacturing organization (NASDAQ: UFPT) headquartered at 100 Hale Street in Newburyport, Massachusetts, with operations across the United States and Mexico. Founded in 1963, the company specializes in medical devices, sterile packaging, and other highly engineered custom products, serving medical segments including robotic-assisted surgery, cardiovascular care, orthopedics, wound care, and infection control, as well as aerospace and defense, automotive, and industrial markets. Because the company manufactures medical devices and works within the healthcare supply chain, it handles sensitive personal, medical, and financial information for a large number of individuals.
What Happened?
UFP Technologies Inc. was listed in a Texas Attorney General data security breach report (record BR-0005493) after a cyberattack compromised sensitive personal information belonging to 10,802 individuals. The company discovered the breach on September 28th, 2026, and notified affected consumers by U.S. Mail. The compromised data included names, addresses, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information.
The underlying attack occurred earlier in the year. UFP Technologies detected suspicious activity on its IT systems on February 14th, 2026, and disclosed the incident to the SEC via Form 8-K on February 19th, 2026. The company confirmed at that time that data had been exfiltrated and that some data was stolen or destroyed, with disruption to billing and label-making systems. The gap of more than seven months between the initial attack and the September 28th, 2026 breach discovery date reported to the Texas AG likely reflects the conclusion of the company’s investigation into which specific categories of personal information were affected. On approximately March 31st, 2026, a ransomware group called “Payouts King” claimed responsibility on a dark web leak site, alleging it stole 620 GB of data from UFP Technologies. UFP has not acknowledged that claim, and Comparitech reported it could not independently verify it. BlackFog’s February 2026 ransomware report confirmed that the incident involved encryption of data and temporary disruption to business operations, and noted that no ransomware group had claimed responsibility at that time.
Active class action litigation is underway. A consolidated federal case, In Re UFP Technologies, Inc. Data Breach Litigation (case no. 1:26-cv-12178), is pending in Massachusetts federal court before Judge Julia E. Kobick. A related case, William Glade et al v. UFP Technologies, Inc., has had interim co-lead class counsel appointed. Law firm Shamis & Gentile P.A. has also announced a separate investigation into the breach.
Key Facts at a Glance
- Company or Organization: UFP Technologies Inc.
- Industry: Medical Devices / Healthcare Manufacturing (contract development and manufacturing organization)
- Location: Newburyport, Massachusetts
- Incident type: Cyberattack involving data exfiltration and encryption; characteristics consistent with ransomware
- Date of breach: February 14th, 2026 (initial attack detected; per SEC Form 8-K disclosure)
- Date breach discovered: September 28th, 2026 (per Texas AG filing; reflects date personal information categories were confirmed compromised)
- Date of consumer notification: November 6th, 2026 (date published at Texas AG website)
- Total persons affected: 10,802
- Prior breach: None identified; this appears to be the company’s first publicly reported data security incident
- Litigation status: Active — In Re UFP Technologies, Inc. Data Breach Litigation, no. 1:26-cv-12178 (D. Mass., Judge Julia E. Kobick); William Glade et al v. UFP Technologies, Inc. (interim co-lead counsel appointed); Shamis & Gentile P.A. investigation announced
- Source: Texas Attorney General Data Security Breach Report (BR-0005493); UFP Technologies SEC Form 8-K (Feb 19, 2026); BleepingComputer; Comparitech; Law360 – Class Action Docket
What Should You Do?
If you received a notice from UFP Technologies Inc., take steps now to protect yourself. Enroll in any identity theft protection services offered in your notification letter and note the enrollment deadline. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Monitor your bank accounts, credit card statements, and credit reports closely for unfamiliar activity. You can request free credit reports at AnnualCreditReport.com. Because medical information and health insurance information were among the data types exposed, also review your Explanation of Benefits statements and medical records for services you did not receive or authorize. If you discover signs of fraud or identity theft, report them at IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
