Almeida Law Group is investigating a data breach at Central National Gottesman Inc. The breach occurred on February 26th, 2026 and was discovered on February 28th, 2026. If you were affected, contact Almeida Law Group.
About Central National Gottesman Inc.
Central National Gottesman Inc. (CNG) is one of the world’s largest distributors of pulp, paper, packaging, nonwovens and fibers, tissue, metals, and wood products. Founded in 1886, the company is a fifth-generation, privately held family business headquartered in Purchase, New York, with estimated annual revenue of $9 billion and more than 4,000 employees across 150-plus locations in 29 countries. In 2023, CNG acquired S.P. Richards, a business products wholesaler. The breadth of data types exposed in this breach—including Social Security numbers, medical information, health insurance details, and financial account information—suggests that employee and HR records were the primary target rather than customer data.
What Happened?
Central National Gottesman Inc. was listed in a Texas Attorney General data security breach report (record BR-0005288). According to that filing, a breach occurred on February 26th, 2026, was discovered on February 28th, 2026, and affected a total of 9,126 people. CNG notified affected individuals by U.S. Mail. The compromised data included names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers, financial account information, medical information, health insurance information, dates of birth, and other information.
Ransomware group Payoutsking (also known as Payouts King) claimed responsibility for the attack as early as March 2nd, 2026, according to reporting by Westfair Communications. On April 30th, 2026, Payoutsking posted the claim on its leak site and threatened to release the data if negotiations were not initiated. These are attacker-side allegations; CNG has not publicly confirmed a ransomware attack, and the Texas AG filing does not specify the attack vector. Separately, two class action complaints were filed on April 6th, 2026, in U.S. District Court for the Southern District of New York by former CNG employees Alexis Romero and Samantha Campbell. Both complaints allege negligence and note that CNG had not acknowledged the breach at the time of filing. The Texas AG published the breach report on August 28th, 2026—roughly six months after the breach date—which may be relevant to affected individuals assessing their exposure window.
Key Facts at a Glance
- Company or Organization: Central National Gottesman Inc.
- Industry: Pulp, paper, packaging, metals, and wood products distribution (wholesale/merchant)
- Location: Purchase, New York 10577
- Incident type: Unauthorized access to personal information; ransomware attack claimed by Payoutsking (attacker allegation, not company-confirmed)
- Date of breach: February 26th, 2026
- Date breach discovered: February 28th, 2026
- Date of consumer notification: Notices sent by U.S. Mail; Texas AG report published August 28th, 2026
- Total persons affected: 9,126
- Prior breach: No prior breaches identified
- Litigation status: Two class action complaints filed April 6th, 2026, in U.S. District Court, Southern District of New York (White Plains), by former employees Alexis Romero and Samantha Campbell
- Source: Texas Attorney General Data Security Breach Report – BR-0005288; Westfair Communications; DeXpose
What Should You Do?
If you received a notice from Central National Gottesman Inc., take the time to review any identity theft protection enrollment offer and sign up before the deadline if one applies. Because this breach involved Social Security numbers, financial account information, and medical and health insurance data, consider placing a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion. Monitor your bank and credit card accounts for unfamiliar transactions, and request your free annual credit reports at AnnualCreditReport.com. If you believe your health or insurance information may have been misused, review your Explanation of Benefits statements and request copies of your medical records to check for services you did not receive. If you spot suspicious activity, report it at IdentityTheft.gov for a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
