Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible Hayward Holdings data breach. According to dark web monitoring sources, a hacker group calling itself Falcon claimed responsibility for a cyberattack on Hayward Holdings in a post first observed in August 2026, alleging it had gained access to internal company systems. As of this writing, Hayward Holdings has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About Hayward Holdings
Hayward Holdings, Inc. (NYSE: HAYW) is a global designer, manufacturer, and marketer of pool equipment and associated automation systems. Founded in 1925 and headquartered in Charlotte, NC, the company makes pumps, filters, robotic cleaners, heaters, LED lighting, water sanitizers, salt chlorine generators, and IoT-enabled smart controls. Hayward sells through specialty distributors, retailers, pool builders, and buying groups across North America, Europe, and internationally, and reported approximately $1.17 billion in trailing twelve-month revenue with around 1,960 employees.
What Happened?
On August 31st, 2026, Ransomware.live reported that the Falcon ransomware group posted a dark-web leak-site claim naming Hayward Holdings as a victim. The group alleged extracting 848 GB of data, claiming it includes Salesforce data, more than one million business and customer records containing personally identifiable information, distributor pricing lists, margin structures, financial records, P&L statements, accounting ledgers, personnel files, IT infrastructure blueprints, privileged account credentials, and board preparation materials. These are attacker-side claims only and have not been confirmed by Hayward Holdings or any independent source. No SEC Form 8-K, state attorney general notification, or mainstream press reporting confirming the incident has been found. No independent corroborating source was identified.
The Falcon group is a newly emerged threat actor first observed in April 2026. GuidePoint Security links Falcon to a broader adversary-in-the-middle phishing and vishing campaign cluster tracked as UNC6671 by Google Threat Intelligence Group and CORDIAL SPIDER by Okta, which also operates under the extortion brands Helix, Pink, and Redact. WatchGuard characterizes Falcon as an emerging data broker group, and SOCRadar reports that as of late August 2026, the group had indexed only two victims and that 100% of its claims remain unconfirmed. Other Falcon claims, including those against DistributionNOW and Globus Medical, have similarly not been confirmed by the targeted companies. The entire claim against Hayward Holdings should be treated as an unverified attacker allegation. A law firm (Migliaccio & Rathod LLP) posted a breach investigation page on September 1st, 2026, soliciting potential victims, but no class action complaint related to this ransomware claim has been filed as of September 2nd, 2026.
Key Facts at a Glance
- Company or Organization: Hayward Holdings, Inc. (NYSE: HAYW)
- Industry: Manufacturing — pool and outdoor living equipment
- Location: Charlotte, NC (headquarters); additional facilities in Arizona, Florida, New Jersey, North Carolina, Rhode Island, Tennessee, Canada, Australia, China, France, and Spain
- Incident type: Ransomware leak-site allegation (unverified)
- Date claim first observed: August 31st, 2026
- Prior breach: None confirmed; Hayward’s 2024 10-K stated no material past cybersecurity incidents
- Litigation status: No lawsuit filed related to this ransomware claim as of September 2nd, 2026. An unrelated securities fraud class action settled for $19.85 million, with final approval granted July 28th, 2026.
- Source: Ransomware leak-site allegation reported by Ransomware.live; Hookphish; GuidePoint Security; SOCRadar; WatchGuard; Board-Cybersecurity.com
What Should You Do?
If you believe your information may have been involved, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. You can request free copies of your credit reports at AnnualCreditReport.com and review them carefully for unfamiliar accounts or inquiries. Monitor your financial accounts regularly for suspicious activity, and report any signs of identity theft at IdentityTheft.gov, where you can also create a personalized recovery plan. Because no consumer notification has been issued in connection with this claim, check Hayward Holdings’ official website and communications for any updates about whether identity protection services will be offered.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
