Rogers Mechanical Contractors, a Georgia-based commercial and industrial mechanical contractor, suffered a major data breach in January 2025, where a threat actor accessed internal systems and exfiltrated sensitive data. The compromised information included personally identifiable information (PII) and protected health information (PHI) such as names, addresses, dates of birth, Social Security numbers, government IDs, medical records, health insurance details, financial account information, and credit/debit card numbers. The breach impacted current and former employees, contractors, and clients, exposing them to risks of identity theft, medical fraud, and financial fraud. The company confirmed the breach after a review completed in July 2025 and began notifying affected individuals in October 2025, offering free credit monitoring and identity protection services. Regulatory disclosures were made to multiple state authorities, including the Massachusetts, Texas, and Vermont Attorney Generals' offices.