On March 18, 2024, the California Office of the Attorney General reported a data breach involving Johnson Matthey, Inc. The breach occurred on February 15, 2024, and involved personal information of employees, including names, Social Security numbers, and dates of birth, which may have been stored without access controls since 2020; however, there is no evidence of unauthorized access to the files.

Johnson Matthey, Inc. experienced an inadvertent disclosure of personal information, reported by the Maine Office of the Attorney General on March 18, 2024. The breach occurred over an extended period, spanning from January 1, 2020, to February 15, 2024, exposing sensitive data of 6,095 individuals, primarily their Social Security numbers (SSNs). The compromised SSNs pose a significant risk of identity theft, financial fraud, and long-term reputational harm to the affected individuals. In response, the company offered 24 months of identity protection services through Experian’s IdentityWorks to mitigate potential damages. The incident highlights vulnerabilities in data handling practices, raising concerns about internal controls and the safeguarding of personally identifiable information (PII). While no ransomware or malicious cyber attack was explicitly mentioned, the scale and nature of the exposed data suggest a severe impact on customer trust and regulatory compliance.