Almeida Law Group is investigating a data breach at Takeda Pharmaceuticals USA, Inc. The breach occurred on February 9th–21st, 2026 and was discovered on February 23rd, 2026. If you were affected, contact Almeida Law Group.
About Takeda Pharmaceuticals USA, Inc.
Takeda Pharmaceuticals USA, Inc. is the U.S. subsidiary of Takeda Pharmaceutical Company Limited, a global biopharmaceutical company founded in 1781 and headquartered in Japan. The U.S. operations are based in Cambridge, Massachusetts. The company focuses on therapeutic areas including oncology, rare diseases, neuroscience, gastrointestinal and inflammatory conditions, plasma-derived therapies, and vaccines. Because this breach involved highly sensitive personal information — including Social Security numbers, medical information, and government-issued identification — the potential harm to affected individuals is significant.
What Happened?
Takeda Pharmaceuticals USA, Inc. was listed in a Texas Attorney General data security breach report (record BR-0005136) published on June 26th, 2026. According to that filing and supplemental reporting, an unauthorized third party compromised an employee’s credentials and had access to Takeda’s systems between February 9th, 2026 and February 21st, 2026. Takeda discovered the intrusion on February 23rd, 2026 and contained it the same day, also notifying law enforcement. On April 24th, 2026, Takeda determined that the unauthorized party could have accessed files containing personal information. By May 5th, 2026, specific affected individuals had been identified. Notification letters were sent beginning May 29th, 2026 via U.S. Mail. In total, 2,435 individuals were affected. The types of information potentially exposed include names, dates of birth, home addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers (such as passports and state ID cards), and medical information.
Takeda has a notable history with data security incidents. The company was among the pharmaceutical companies affected by the February 2024 Cencora (formerly AmerisourceBergen) data breach, which impacted over 1.43 million individuals and resulted in a $40 million class action settlement. In April 2025, a threat actor using the alias “beltway” claimed to have exfiltrated approximately two million rows of user data from Takeda.com and listed it for sale at $75,000; Takeda acknowledged the claim and said it was investigating. This February 2026 breach is a separate, distinct incident involving a compromised employee credential. Shamis & Gentile P.A. has publicly announced an investigation into this 2026 breach for a potential class action lawsuit, though no filed complaint has been reported as of the research date. Takeda is offering 24 months of Experian IdentityWorks credit monitoring with $1 million in identity theft insurance to affected individuals.
Key Facts at a Glance
- Company or Organization: Takeda Pharmaceuticals USA, Inc.
- Industry: Pharmaceuticals / Biopharmaceuticals
- Location: Cambridge, Massachusetts
- Incident type: Unauthorized access via compromised employee credentials
- Date of breach: February 9th, 2026 – February 21st, 2026
- Date breach discovered: February 23rd, 2026
- Date of consumer notification: May 29th, 2026
- Total persons affected: 2,435
- Identity theft protection offered: 24 months of Experian IdentityWorks credit monitoring with $1 million identity theft insurance
- Prior breach: Yes — affected in 2024 Cencora breach; April 2025 alleged Takeda.com data sale (unconfirmed)
- Litigation status: Shamis & Gentile P.A. investigating for potential class action; no filed complaint reported as of research date
- Source: Texas Attorney General data security breach report, BR-0005136 (https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005136); supplemental reporting at https://www.claimdepot.com/data-breach/takeda-pharmaceuticals-2026
What Should You Do?
If you received a notification letter from Takeda, enroll in the Experian IdentityWorks credit monitoring that is being offered — check your letter for the enrollment deadline and activation code. Beyond that, consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) to make it harder for anyone to open new accounts in your name. Monitor your existing financial accounts and credit reports closely for any unfamiliar activity. You can request a free credit report from each bureau at AnnualCreditReport.com. Because medical information was involved in this breach, also review any Explanation of Benefits statements from your health insurer and check your medical records for any services you do not recognize. If you suspect your information has been misused, visit IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
