Central National Gottesman

A ransomware attack on Central National Gottesman Inc. exposed a wide range of personal information belonging to employees, customers, and other individuals, according to breach notifications and filings described in public reporting. The company, a private, family-owned distributor of pulp, paper, and packaging products based in Purchase, New York, began notifying affected people by U.S. Mail on August 28, 2026. The investigation team has indexed 207,519 records from this breach, containing names for every record as well as Social Security numbers, dates of birth, email addresses, phone numbers, street addresses, driver's license numbers, and vehicle information.

Breach Timeline

March 2, 2026: The ransomware group Payouts King reportedly attacked Central National Gottesman's network, according to reporting by PR Newswire. One investigation summary places the initial intrusion on or around February 26, 2026.

March 12, 2026: Payouts King posted on the Tor network claiming it had stolen 726 gigabytes of the company's internal data and intended to publish it within six to seven days, per ClaimDepot. The group described the trove as including executive email exports, employee and customer records, contracts, payroll data, and database backups.

May 6, 2026: Former employee Alexis Romero filed a putative class action against the company in the Southern District of New York, alleging a data breach on March 2, 2026. A second, similar suit by former employee Samantha Campbell was later consolidated with it, according to court records.

August 28, 2026: The company began mailing breach notification letters to affected individuals and disclosed the incident to state authorities in late August.

September 1, 2026: The law firm Edelson Lechtzin LLP announced it was investigating potential data privacy claims on behalf of affected individuals.

What Information Was Compromised?

Our analysis found the following data types in this breach: names on all 207,519 indexed records, plus Social Security numbers (19,916), dates of birth (21,372), email addresses (58,823), phone numbers (51,821), street addresses (27,172), driver's license numbers (196), vehicle identification numbers (1,193), and vehicle license plate numbers (160).

According to breach notifications cited in reporting by ClaimDepot and PR Newswire, the exposed data may also include government-issued identification numbers such as passports and state ID cards, financial information including account and payment card numbers, medical and health insurance information, and payroll-related details.

Not every individual is affected by every type of data listed here.

The state filings identified so far cover 843 Texas residents, 568 Massachusetts residents, and 22 Vermont residents, among others. The full scope of affected individuals has not been publicly confirmed.

What Are the Potential Risks for Affected Individuals?

The combination of Social Security numbers, dates of birth, and financial account details creates a heightened, long-term risk of identity theft and financial fraud. Criminals can use this information to open new accounts, file fraudulent tax returns, or impersonate victims to lenders and government agencies.