Ohio based Cornwell Quality Tools hit by ransomware attack
Learn More
Cornwell Quality Tools, an Ohio-based mobile tool supplier, reports a ransomware attack that compromised the personal information of 103,782 individuals across the United States.
The company specializes in designing, manufacturing, and distributing professional-grade tools for mechanics and technicians, primarily serving the automotive and heavy-duty repair industries.
The attack occurred on or around December 12, 2024, when an unknown actor gained access to Cornwell's network and potentially acquired certain files. The company became aware of the incident on December 20, 2024. The forensic investigation determined that hackers had breached the network and gained access to sensitive files.
The ransomware group Cactus claimed responsibility for the breach in February 2025, alleging they had stolen 4.6 terabytes of data from the company. Cactus posted sample images of what they claimed were stolen documents, including driver's license scans, tax documents, and credit applications
Exposed data includes
- Names and personal identifiers
- Social Security numbers
- Tax documents
- Credit applications and financial account numbers
- Driver's license information
- Medical information and protected health information
The company reported the incident to regulators on September 9, 2025.
Cornwell is offering eligible victims 12 months of free credit monitoring and $1 million in identity fraud insurance, with an enrollment deadline of December 4, 2025.
