Ufp Technologies Inc discloses a cybersecurity incident with data taken without authorization (SEC 8-K, February 2026)
On or about February 14, 2026, UFP Technologies, Inc. (the “Company”) detected suspicious activity involving its information technology (“IT”) systems.
What happened
- Upon detecting the issue, the Company began taking steps to assess, contain, and remediate the unauthorized activity, including isolating the affected systems and launching an investigation with the assistance of external cybersecurity advisors.Form 8-K Item 1.05, Ufp Technologies Inc, filed 2026-02-24
- Through the Company’s efforts, the Company believes that the third party responsible for this cybersecurity incident has been removed from the Company’s IT systems, and the Company’s ability to access information impacted by this incident has been restored in all material respects.Form 8-K Item 1.05, Ufp Technologies Inc, filed 2026-02-24
- The incident appears to have impacted many but not all of the Company’s IT systems and affected functions such as billing and label making for customer deliveries.Form 8-K Item 1.05, Ufp Technologies Inc, filed 2026-02-24
The failure pattern
Watch the pattern: Audit trail missing actor, target or decision
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Amgen Inc discloses a cybersecurity incident with data taken without authorization (SEC 8-K, July 2026)
In July 2026, Amgen Inc. (the "Company") identified unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers.
AT&T Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, July 2024)
On April 19, 2024, AT&T Inc. (“AT&T”) learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs.
Orasure Technologies Inc discloses a cybersecurity incident with data taken without authorization (SEC 8-K, April 2024)
On or about March 27, 2024, OraSure Technologies, Inc. (the “Company”) became aware of a cybersecurity incident in which an unauthorized third party gained access to Company data from certain information systems.
Cencora, Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, February 2024)
On February 21, 2024, Cencora, Inc. (the “Company”), learned that data from its information systems had been exfiltrated, some of which may contain personal information.
Hewlett Packard Enterprise Co discloses a cybersecurity incident with data taken without authorization (SEC 8-K, January 2024)
On December 12, 2023, Hewlett Packard Enterprise Company (the “Company,” “HPE,” or “we”) was notified that a suspected nation-state actor, believed to be the threat actor Midnight Blizzard, the state-sponsored actor also…
Microsoft Corp discloses a cybersecurity incident with data taken without authorization (SEC 8-K, January 2024)
On January 12, 2024, Microsoft (the “Company” or “we”) detected that beginning in late November 2023, a nation-state associated threat actor had gained access to and exfiltrated information from a very small percentage…