McCormick Taylor, Inc. data breach

What we know

McCormick Taylor, Inc. is a prominent professional services, engineering, and infrastructure consulting firm providing comprehensive planning, environmental, and design solutions primarily to public sector and government clients. Because the organization partners extensively with state departments of transportation, federal agencies, and municipal authorities, it routinely handles vast quantities of highly sensitive, confidential information. This includes not only proprietary engineering blueprints and project schematics, but also extensive internal personnel records, background investigation documents, and detailed employee compensation files. To support its large workforce across multiple regional offices, McCormick Taylor maintains centralized human resources databases containing deeply personal records for current and former employees, making it a repository for valuable and targeted data.

In 2025, McCormick Taylor, Inc. formally reported a significant data security incident to the Office of the Attorney General for the State of Maryland. While specific technical disclosures continue to be evaluated, incidents affecting engineering and professional consulting firms typically involve sophisticated network intrusions, unauthorized access to corporate file repositories, or compromised third-party vendor platforms. In many instances, malicious actors exploit unpatched network vulnerabilities or utilize credential-harvesting techniques to infiltrate internal servers, potentially dwelling undetected within the corporate network for weeks or months to exfiltrate proprietary business files and confidential human resources archives before deploying encryption or demanding ransom.

Based on the typical scope of data maintained by professional service providers and engineering firms, the types of information compromised in the McCormick Taylor breach likely include full legal names, Social Security numbers, dates of birth, home addresses, banking and direct deposit information, and detailed tax withholding records. The unauthorized exposure of this data category creates immediate and severe risks of identity theft, financial fraud, and unauthorized tax filings. When Social Security numbers and banking details are compromised together, victims face a heightened danger of financial account takeover, fraudulent credit applications, and unauthorized withdrawals, exposing them to prolonged financial distress and administrative burdens to restore their credit integrity.

As an entity entrusted with sensitive personally identifiable information, McCormick Taylor, Inc. had clear legal obligations under state data protection statutes, the Maryland Personal Information Protection Act (MPIPA), and common law principles of negligence to implement and maintain robust cybersecurity safeguards. Organizations holding this caliber of employee and corporate data are required to utilize multi-factor authentication, robust encryption standards, continuous network monitoring, and regular vulnerability assessments. The occurrence of a successful security breach strongly suggests a failure to uphold these standard industry-security protocols, raising serious questions regarding whether the company's data protection measures were adequate to fend off foreseeable cyber threats.

Receiving an official data breach notification letter from McCormick Taylor, Inc. serves as formal legal acknowledgment that your private information was compromised due to corporate security failures. Legally, the receipt of this notice establishes standing to participate in a class action lawsuit aimed at holding the company accountable for its inadequate data security practices. Affected individuals do not need to wait until they experience actual financial loss or identity theft to take legal action; the increased risk of future harm alone is sufficient. Our firm evaluates these cases on a strict contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.

See every breach reported in Maryland or read what to do after a ransomware attack.