Perrigo Company data breach

What we know

Perrigo Company is a prominent global consumer self-care and over-the-counter (OTC) health products manufacturer and distributor. Because of its core operations in developing, manufacturing, and distributing wellness products, infant formula, and store-brand healthcare items, the company routinely collects and maintains vast repositories of sensitive information. This includes comprehensive employee records, payroll data, proprietary research, vendor banking information, and customer service databases containing personally identifiable information. Operating at a global scale means the organization acts as a central hub for complex supply chains, human resources infrastructure, and consumer interactions, thereby accumulating a high concentration of confidential data that makes it an attractive target for malicious actors.

In 2026, Perrigo Company officially reported a significant security incident to the Maine Attorney General, alerting regulators and affected individuals to a compromise of its digital network. While the precise vectors of such corporate data breaches often involve sophisticated ransomware deployment, unauthorized access to internal database servers, or third-party vendor compromises, incidents of this magnitude typically stem from vulnerabilities in perimeter security or compromised administrative credentials. When an enterprise in the manufacturing and consumer healthcare sector experiences a network intrusion, unauthorized parties can often dwell undetected within the system for extended periods, exfiltrating proprietary documents and confidential personnel files before security teams can contain the threat.

The data compromised in this security incident typically encompasses a wide array of sensitive information, including full names, dates of birth, Social Security numbers, banking details, and comprehensive personnel or customer files. The exposure of this specific blend of information creates immediate and severe risks for affected individuals. When Social Security numbers and dates of birth are exposed alongside financial or employment details, victims face a heightened, long-term threat of identity theft, unauthorized credit openings, tax fraud, and targeted phishing schemes. Unlike a single-use password, core identifiers like Social Security numbers cannot be changed, leaving victims vulnerable to ongoing exploitation for years after the initial breach.

As an entity handling sensitive personal and financial data, Perrigo Company was bound by strict legal obligations under state and federal frameworks, including state data protection statutes and the Federal Trade Commission Act, to implement and maintain robust cybersecurity safeguards. These legal mandates require companies to deploy appropriate administrative, technical, and physical security measures—such as multi-factor authentication, encryption, and regular vulnerability assessments—to protect consumer and employee data from unauthorized access. The occurrence of a widespread data breach strongly indicates a failure to maintain these required security standards, raising serious questions about whether the company neglected its duty of care to protect the private information entrusted to its care.

Receiving an official data breach notification letter from Perrigo Company serves as formal legal acknowledgment that your private information was compromised due to inadequate corporate security measures. Under the law, this notification establishes the legal standing necessary to participate in a class action lawsuit aimed at holding the company accountable. Importantly, affected individuals do not need to prove that they have already suffered actual financial loss or identity theft to seek legal recourse; the increased risk of future harm and the loss of privacy are sufficient grounds for action. Our firm handles these complex data breach cases on a contingency fee basis, meaning you pay absolutely nothing out of pocket unless we successfully recover compensation on your behalf.

See every breach reported in Maine or read what to do after a ransomware attack.