Almeida Law Group is investigating a data breach at Sullivan Environmental Services, Inc. The breach occurred on September 4th–5th, 2025 and was discovered on September 5th, 2025. If you were affected, contact Almeida Law Group.
About Sullivan Environmental Services, Inc.
Sullivan Environmental Services, Inc. is based in Galveston, Texas and operates as part of the Sullivan Brothers Family of Companies under the Sullivan Interests umbrella. The company provides residential, multi-family, and commercial services including insulation, mold remediation, duct cleaning and sealing, and dryer vent cleaning. Sullivan Interests is a diversified group of companies offering environmental remediation, disaster recovery, construction, infrastructure, and industrial services across North America, with a particular focus along the Texas Gulf Coast.
What Happened?
Sullivan Environmental Services, Inc. was listed in a Texas Attorney General data security breach report (BR-0005223, published August 4th, 2026). According to the filing, the breach occurred over September 4th–5th, 2025, was discovered on September 5th, 2025, and affected 1,231 individuals in total. Consumers were notified by U.S. Mail. The confirmed compromised data types include names, Social Security numbers, driver’s license numbers, financial account information, and health insurance information.
On October 30th, 2025, the Akira ransomware group claimed responsibility for a cyberattack against Sullivan Interests (sullivaninterests.com), the parent organization of Sullivan Environmental Services. According to Akira’s leak-site post, as reported by DeXpose and RedPacket Security, the group alleged it had obtained approximately 40 GB of corporate documents and threatened to release them. The attacker further claimed the stolen material included employee passports, dates of birth, driver’s license numbers, Social Security numbers, accounting records, contracts, incident reports, police reports, and W-9 tax forms. These are attacker-side claims from a ransomware leak site and have not been confirmed by the company or a regulator. The breach dates confirmed in the Texas Attorney General filing—September 4th–5th, 2025—precede the Akira leak-site posting by approximately two months, a timeline consistent with a ransomware attack followed by a later public disclosure after failed negotiations, though that sequence has not been confirmed by the company. The nearly eleven-month gap between breach discovery in September 2025 and the OAG report’s publication on August 4th, 2026 is also notable.
Key Facts at a Glance
- Company or Organization: Sullivan Environmental Services, Inc.
- Industry: Environmental services / Specialty trade contractors
- Location: Galveston, Texas
- Incident type: Unauthorized access (ransomware attack claimed by Akira group)
- Date of breach: September 4th, 2025 – September 5th, 2025
- Date breach discovered: September 5th, 2025
- Total persons affected: 1,231
- Source: Texas Attorney General data security breach report, BR-0005223 (https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005223); DeXpose (https://www.dexpose.io/akira-ransomware-targets-sullivan-interests/); RedPacket Security (https://www.redpacketsecurity.com/akira-ransomware-victim-sullivan-interests/)
What Should You Do?
If you received a notification letter from Sullivan Environmental Services, Inc., take steps now to protect yourself. Review any identity theft protection services the company may be offering and enroll before any stated deadline. Place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—to make it harder for someone to open new accounts in your name. Monitor your bank and credit card accounts closely for unauthorized transactions, and pull your free credit reports at AnnualCreditReport.com to check for accounts or inquiries you do not recognize. Because health insurance information was among the confirmed compromised data types, also review any Explanation of Benefits statements from your insurer and check your medical records for services you did not receive. If you spot anything suspicious, report it to the Federal Trade Commission at IdentityTheft.gov, which can walk you through a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
