Almeida Law Group is investigating a data breach at SunSource Borrower LLC (“SunSource”). The breach occurred on March 31st, 2026 – April 5th, 2026 and was discovered on May 27th, 2026. If you were affected, contact Almeida Law Group.
About SunSource Borrower LLC (“SunSource”)
SunSource is a national industrial distributor headquartered in Addison, Illinois, with more than 250 locations across North America and Oceania. The company distributes hydraulics, pneumatics, filtration, hoses and fittings, lubrication, automation, and motion control products, and also provides design, system assembly, fabrication, and repair services. It is a portfolio company of private equity firm Clayton, Dubilier & Rice and serves more than 20,000 original equipment manufacturers and industrial end users. The breach exposed a notably broad range of personal data, including medical and health insurance information alongside financial and government-issued identification records.
What Happened?
SunSource Borrower LLC (“SunSource”) was listed in a Texas Attorney General data security breach report filed on June 18th, 2026. The filing indicates that the breach window ran from March 31st, 2026 through April 5th, 2026, and that SunSource discovered it on May 27th, 2026 — nearly two months after the breach ended. A total of 12,463 individuals were affected. SunSource notified affected consumers by U.S. Mail. The compromised data included names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers, financial account information, medical information, health insurance information, and dates of birth.
The ransomware group known as “Payoutsking” claimed SunSource as a victim on its dark web leak site. RedPacket Security reported that the claim was posted on or around April 20th, 2026, and Ransomware.live tracked the listing under Payoutsking with an estimated attack date of April 20th, 2026. These details are consistent with, though not perfectly aligned with, the breach window reported to the Texas Attorney General. Class Action U has listed the SunSource breach as an active data breach investigation, but no filed class action complaint had been identified as of June 18th, 2026. No prior data breaches for SunSource were found in public sources.
Key Facts at a Glance
- Company or Organization: SunSource Borrower LLC (“SunSource”)
- Industry: Industrial distribution (fluid power, pneumatics, automation, motion control)
- Location: Addison, Illinois
- Incident type: Ransomware (Payoutsking group claimed responsibility)
- Date of breach: March 31st, 2026 – April 5th, 2026
- Date breach discovered: May 27th, 2026
- Date of consumer notification: June 18th, 2026
- Total persons affected: 12,463
- Prior breach: None identified
- Litigation status: Listed as an active investigation by Class Action U; no filed class action complaint found as of June 18th, 2026
- Source: Texas Attorney General data security breach report (BR-0005121) — https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005121; RedPacket Security — https://www.redpacketsecurity.com/payoutsking-ransomware-victim-sunsource/; Ransomware.live — https://www.ransomware.live/map/US
What Should You Do?
If you received a notification letter from SunSource, take steps now to protect yourself. Because the breach involved Social Security numbers, financial account information, and health and medical records, the risk of identity theft and fraud is significant. Place a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports for unfamiliar accounts or inquiries at AnnualCreditReport.com. Review your bank and financial account statements for unauthorized transactions. Because medical and health insurance information was compromised, also review your Explanation of Benefits statements and request copies of your medical records to check for services you did not receive. If you suspect misuse of your personal information, report it at IdentityTheft.gov. If SunSource offered identity theft protection services in its notification letter, consider enrolling before any stated deadline.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
