In September 2025, Merck Sharpe & Dohme LLC experienced a data breach via its third-party service provider, Graebel Companies Inc., which manages employee relocation services. Unauthorized access to Graebel’s systems exposed sensitive personally identifiable information (PII) of current and former Merck employees. The compromised data includes names, dates of birth, addresses, phone numbers, Social Security numbers, and financial account details. Merck confirmed the breach after an internal review and reported it to the Massachusetts Attorney General’s office in November 2025. Affected individuals were notified, and the company offered free identity theft protection services (Cyberscout) to mitigate risks. The full scope of the breach remains undetermined but is potentially significant, with legal firms investigating compensation claims for victims, including reimbursement for financial losses, time spent resolving issues, and emotional distress.