By Gregory Hale
Industrial maintenance provider, Irving, Texas-based NCH Corporation suffered a cyberattack in January and after its investigation, it is now informing victims their personally identifiable information ended up stolen in the hack.
“On March 9, 2026, we became aware that an unauthorized actor may have taken files from our network,” the company said in a letter to victims. “We immediately implemented our response procedures, took containment measures, and launched an investigation with the support of third-party cybersecurity professionals. We also notified law enforcement and are supporting its investigation.”
In the investigation, NCH said the evidence showed there was unauthorized activity on its network between January 21, 2026, and February 25, 2026.
“We are a company that provides industrial maintenance, water treatment, and hygiene solutions,” the company said in its advisory. “We have your information because you are a current or former employee, the dependent or beneficiary of a current or former employee, or for another business-related reason.”
During the time of the attack, an unauthorized actor obtained copies of certain files from the NCH network. The company completed its review of the files involved on October 2 and determined what information ended up stolen and to whom it belonged.
Stolen Data
The files included victims’ name, Social Security number, taxpayer identification number, driver’s license number, and/or state identification card number. The files also may have included one or more of the following: Passport number, other government-issued identification number, financial account information, payment card information, medical information, and/or health insurance information.
NCH fell victim to an attack in August 2025.
The company suffered from an attack via a third-party vendor vulnerability where personally identifiable information ended up stolen.
“NCH like multiple other organizations use Oracle’s E-Business Suite (“EBS”) software to help manage their operations,” the company said in a notice to victims. “In August 2025, an unauthorized actor leveraged a previously unknown vulnerability in Oracle EBS to take information from numerous organizations’ Oracle EBS applications. NCH learned it was one of those organizations.”
Previous Attack
Upon becoming aware of the incident, NCH immediately implemented its response procedures, took measures to secure its implementation of Oracle EBS, and launched an investigation with the support of third-party cybersecurity professionals. NCH also notified law enforcement and is supporting its investigation.
The evidence showed an unauthorized actor obtained files from the NCH Oracle EBS application in mid-August. NCH reviewed the files and, on November 25, determined one or more of the files contained the names, date of birth, Social Security numbers, and benefits enrollment information.
NCH Corporation is a global manufacturer and provider of industrial, commercial, and institutional maintenance products and services. The company cleans and conserves water, saves energy, and delivers maintenance solutions, with a focus on industrial and commercial businesses. NCH has over 23,000 employees, with branch offices and manufacturing plants located on six continents. It distributes to over 160 countries.
No further information was immediately available on who was behind the attack and what kind of attack it was.
For more information on other incidents in the industry click on ICSSTRIVE.com.