Almeida Law Group is investigating a data breach at Martin Brother Distributing Company, Inc. If you were affected, contact Almeida Law Group.
About Martin Brother Distributing Company, Inc.
Martin Brothers Distributing Company, Inc. (d/b/a Martin Bros.) is a family- and employee-owned full-line foodservice distributor founded in 1940, headquartered in Cedar Falls, Iowa. The company distributes food, restaurant equipment, supplies, janitorial products, and kitchen equipment to restaurants, healthcare facilities, schools, and convenience stores across Iowa and surrounding Midwest states. With approximately 501–1,000 employees and roughly $444.2 million in annual revenue, Martin Bros. also administers employee benefit plans, which brought it within the scope of federal health privacy law and made it a covered entity under HIPAA.
What Happened?
Martin Brother Distributing Company, Inc. was listed in a HHS Office for Civil Rights breach portal report submitted on September 29th, 2026. The reported incident type is a hacking/IT incident affecting a network server, and the filing notes that a business associate was present — consistent with the breach having originated at a third party rather than at Martin Brothers itself.
According to the Indiana Attorney General’s records and local news coverage, the third party involved was PDCM Insurance, a Waterloo, Iowa-based insurance brokerage that handled certain employee benefit administration functions for Martin Brothers. Unauthorized access to files on PDCM’s network occurred on April 27th–28th, 2025. PDCM discovered suspicious network activity on April 28th, 2025, but its investigation did not confirm until February 17th, 2026, that information belonging to Martin Brothers individuals was involved. Formal notification to Martin Brothers, regulators, and affected consumers was sent on August 3rd, 2026 — approximately 15 months after the unauthorized access occurred. A total of 2,303 individuals are listed as affected in the Martin Brothers HHS filing. The broader PDCM breach reportedly affected 39,759 individuals total, per the Texas Attorney General’s report.
Data types exposed in connection with the Martin Brothers notification reportedly include names, contact information, dates of birth, Social Security numbers, driver’s license numbers, employer-assigned identification numbers, insurance policy information, insurance claim information, medical information, and billing information.
The LockBit 3.0 ransomware group claimed responsibility for the PDCM attack around May 1st, 2025, according to threat intelligence trackers. This is an attacker-side claim and has not been confirmed by PDCM or any regulator; PDCM’s own public statements describe only suspicious network activity and unauthorized access. The Iowa Attorney General’s notice has been cited by at least one source as characterizing the incident as a ransomware attack, though that characterization has not been independently verified. No filed class action lawsuit specific to the Martin Brothers filing has been identified, but Shamis & Gentile P.A. and other law firms are publicly investigating for potential class action claims.
Key Facts at a Glance
- Company or Organization: Martin Brother Distributing Company, Inc.
- Industry: Wholesale foodservice distribution (Health Plan covered entity)
- Location: Cedar Falls, Iowa
- Incident type: Hacking/IT Incident (network server)
- Date of breach: April 27th, 2025
- Date breach discovered: April 28th, 2025
- Date of consumer notification: August 3rd, 2026
- Total persons affected: 2,303
- Prior breach: None identified (a 2014 antitrust class action settlement unrelated to data security)
- Litigation status: No filed class action specific to this breach identified; Shamis & Gentile P.A. and other firms publicly investigating
- Source: HHS Office for Civil Rights breach portal report; Indiana AG October Year-to-Date Breach Report 2026; Waterloo-Cedar Falls Courier; ClaimDepot investigation page
What Should You Do?
If you received a notice from Martin Brothers or PDCM Insurance about this breach, consider taking steps now to protect yourself. Because Social Security numbers, medical information, and other sensitive data were reportedly exposed, you should place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion. Review your credit reports for any unfamiliar accounts or activity at AnnualCreditReport.com. If identity theft does occur, report it at IdentityTheft.gov for a personalized recovery plan. Because medical and insurance information was reportedly involved, carefully review any Explanation of Benefits statements from your health plan and check your medical records for services you did not receive. If identity protection enrollment was offered in the notification letter, enroll before any deadline stated in your notice. Monitor your financial accounts, insurance accounts, and any accounts that use credentials that may have been exposed.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
