Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible Applied Composites data breach. According to dark web monitoring sources, a hacker group calling itself Storm claimed responsibility for a cyberattack on Applied Composites in a post first observed in September 2026, alleging it had gained access to internal company systems. As of this writing, Applied Composites has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About Applied Composites
Applied Composites Holdings, LLC is a privately held aerospace and defense manufacturer headquartered at 25671 Commercentre Drive, Lake Forest, California. Founded in 1982 and currently a portfolio company of AE Industrial Partners, it manufactures complex composite components, assemblies, and tooling for aircraft, engines, missiles, unmanned aerial vehicles, satellites, and launch vehicles. The company operates approximately 570,000 square feet across six facilities in California, Indiana, and Ohio, and employs roughly 850 people. Because Applied Composites serves the defense-industrial base, a breach involving its systems could potentially implicate sensitive technical or proprietary data, though no specific data types have been identified or claimed in connection with this incident.
What Happened?
Applied Composites was listed as a victim on a ransomware leak site in an allegation reported by Ransomware.live on September 26th, 2026, with the attack attributed to a group calling itself Storm. The claim is attacker-side only — a dark web allegation — and Applied Composites has not issued any public statement, breach notification, or regulatory filing confirming the incident.
Two independent breach-monitoring services have flagged the claim. Breachsense separately indexed the Storm group’s allegation against the appliedcomposites.com domain, noting a discovery date of September 25th, 2026. HackNotice also surfaced Applied Composites in its monitoring streams around the same time. As context, the Storm group has claimed attacks against multiple U.S. organizations in mid-to-late 2026. Microsoft tracks a potentially related threat actor designated Storm-1175, assessed as financially motivated and linked to Medusa ransomware deployments; in August 2026, it deployed a new private encryptor called StormEncryptor. Whether the “Storm” leak-site brand and Microsoft’s Storm-1175 designation refer to the same entity has not been confirmed. No specific data types compromised at Applied Composites have been identified or claimed, and no prior breaches or related litigation involving this company were found.
Key Facts at a Glance
- Company or Organization: Applied Composites (Applied Composites Holdings, LLC)
- Industry: Aerospace and Defense Manufacturing
- Location: Lake Forest, California (additional facilities in San Diego, CA; Indianapolis, IN; Los Alamitos, CA; Brea, CA; and Cleveland, OH)
- Incident type: Ransomware leak-site allegation (dark web claim, unconfirmed)
- Source: Ransomware.live – Applied Composites Victim Page · Breachsense – Recent Data Breaches · HackNotice – Applied Composites · PitchBook – Applied Composites
What Should You Do?
Even though Applied Composites has not confirmed a breach, it is reasonable to take precautionary steps if you have any connection to the company. Consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Review your credit reports for unfamiliar activity at AnnualCreditReport.com, and monitor your financial accounts closely for any suspicious transactions. If you receive any identity theft protection enrollment offer related to this incident, enroll promptly and note any applicable deadline. If you believe your information has been misused, visit IdentityTheft.gov for step-by-step guidance.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
